CVE-2026-16962: Tamara Checkout WordPress Auth Bypass Flaw

CVE-2026-16962 Overview

CVE-2026-16962 is a missing authorization vulnerability [CWE-862] in the Tamara Checkout WordPress plugin through version 1.9.9.20. The plugin exposes public payment cancel and fail return URLs that update WooCommerce order status based solely on an attacker-supplied numeric order id. The endpoints do not validate the order key, verify a nonce, or check user capability. An unauthenticated attacker can enumerate order ids and force cancellation or failure of arbitrary orders across the store. Downstream effects include automatic stock release and customer notifications.

Critical Impact

Unauthenticated attackers can cancel or fail any WooCommerce order store-wide by enumerating numeric order ids, disrupting fulfillment, inventory, and customer communications.

Affected Products

• Tamara Checkout WordPress plugin versions through 1.9.9.20
• WordPress sites running WooCommerce with the Tamara payment gateway enabled
• E-commerce deployments accepting Tamara buy-now-pay-later checkout

Discovery Timeline

• 2026-08-21 - CVE-2026-16962 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16962

Vulnerability Analysis

The Tamara Checkout plugin registers public return URLs that handle payment cancel and fail flows after a shopper is redirected back from the Tamara payment provider. These handlers accept a numeric WooCommerce order id from the request and directly transition the corresponding order to a cancelled or failed state.

The handlers omit three controls expected on a state-changing endpoint. They do not compare the supplied order key against the order's stored key. They do not validate a WordPress nonce tied to the checkout session. They do not check the acting user's capability. Because the endpoints are reachable without authentication, any anonymous request that provides a valid order id succeeds.

The impact extends beyond the order status field. WooCommerce triggers woocommerce_order_status_cancelled and woocommerce_order_status_failed hooks, releasing reserved stock, sending merchant and customer emails, and firing webhooks. An attacker can degrade store operations without authentication.

Root Cause

The root cause is a missing authorization check [CWE-862] on public payment return endpoints. Secure WooCommerce gateway callbacks typically require both the order id and a per-order order_key value that is hard to guess. The Tamara Checkout return handlers rely on the order id alone, treating any request that reaches the endpoint as a legitimate provider callback.

Attack Vector

Exploitation requires network access to the storefront and no privileges. An attacker iterates numeric order ids and issues HTTP requests to the plugin's payment cancel and fail return URLs. Because order ids in WooCommerce increment sequentially, enumeration is straightforward. Each successful request transitions the target order to cancelled or failed, releases stock, and dispatches notifications. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16962

Indicators of Compromise

• Sudden clusters of WooCommerce orders transitioning to cancelled or failed status without a corresponding customer session
• HTTP GET requests to Tamara Checkout return endpoints from IPs that never initiated a checkout
• Sequential access patterns against order id parameters in web server logs
• Unexpected stock-restore events and outbound order status emails in WooCommerce logs

Detection Strategies

• Correlate WooCommerce order status change events with the originating IP and user agent, and flag transitions initiated by unauthenticated requests
• Alert on high-rate access to Tamara payment return URLs with varying numeric order id parameters
• Compare submitted order key parameters against stored order_key values and log any mismatches

Monitoring Recommendations

• Ingest WooCommerce and web server access logs into a centralized analytics platform to baseline normal cancel and fail rates
• Track woocommerce_order_status_cancelled and woocommerce_order_status_failed hook volume per hour and alert on deviations
• Monitor referrer and session cookies on payment return requests to distinguish real customer redirects from scripted enumeration

How to Mitigate CVE-2026-16962

Immediate Actions Required

• Update the Tamara Checkout plugin to a version later than 1.9.9.20 once released by the vendor
• Audit recent order status changes and restore orders that were cancelled or failed without a matching customer interaction
• Restrict access to the plugin's payment return URLs at the web server or WAF layer until a patched version is installed

Patch Information

No fixed version is listed in the NVD entry at time of publication. Refer to the WPScan Vulnerability Report for the current patch status and monitor the vendor's plugin listing for an updated release.

Workarounds

• Disable the Tamara Checkout plugin if the Tamara payment method is not actively required for the storefront
• Deploy a WAF rule that requires a valid order_key parameter on Tamara payment cancel and fail return URLs and blocks requests missing it
• Rate-limit requests to plugin return endpoints and block sequential numeric enumeration of the order id parameter

# Example WAF rule (ModSecurity) blocking Tamara return URLs missing an order_key parameter
SecRule REQUEST_URI "@rx /wc-api/(tamara[^/?]*cancel|tamara[^/?]*fail)" \
    "id:1016962,phase:1,deny,status:403,\
     chain,msg:'CVE-2026-16962 Tamara Checkout missing order_key'"
  SecRule &ARGS:order_key "@eq 0"