CVE-2026-16962 is a missing authorization vulnerability (CWE-862) in the Tamara Checkout WordPress plugin through version 1.9.9.20. The plugin fails to verify the order key, nonce, or any capability on its public payment cancel/fail return URLs. Consequently, an unauthenticated attacker can manipulate the status of WooCommerce orders by enumerating numeric order IDs, causing orders to be canceled or marked as failed without proper authorization checks.

An attacker without authentication can cancel or fail arbitrary orders store-wide by exploiting the lack of authorization checks on the payment cancel/fail URLs. This can lead to unintended stock releases and trigger order-related notifications, disrupting order management and potentially causing financial and operational impacts for the store owner.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected URLs if possible or monitor for suspicious activity related to order status changes. Avoid exposing numeric order IDs publicly and consider implementing additional authorization checks on these endpoints.