Unauthenticated Order Manipulation in Tamara Checkout Plugin for WooCommerce
CVE-2026-16962
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 August 2026
Badges
What is CVE-2026-16962?
The Tamara Checkout plugin for WordPress is susceptible to a vulnerability where it fails to properly verify the order key and nonce during payment cancellation and failure processes. This fault allows an unauthenticated attacker to manipulate WooCommerce order statuses by simply providing numeric order IDs. As a result, they can cancel or mark any order as failed, leading to unintended inventory releases and notifications across the store. Proper validation mechanisms should be implemented to safeguard against unauthorized actions.
Affected Version(s)
Tamara Checkout 0 <= 1.9.9.20
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.