Vulnerability · Published Aug 21, 2026 · Assigned by WPScan

CVE-2026-16962Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation

Medium 5.3

In plain English

A medium-severity missing authorization in Tamara Checkout from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).

Affected products (as reported)

Vendor	Product	Versions
Unknown	Tamara Checkout	0 – through 1.9.9.20

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/e026c89e-83cc-452c-bfb9-2630f1ade284/ exploit, vdb-entry, technical-description