Description

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T07:16:25.040Z",
  "pubdate": "2026-08-21T07:16:25.040Z",
  "executiveSummary": "An insecure direct object reference and missing authorization vulnerability exists in the Tamara Checkout WordPress plugin through version 1.9.9.20. The vulnerability allows unauthenticated attackers to manipulate WooCommerce order statuses across the entire store.\nSpecifically, the public payment cancel and fail return URLs fail to validate cryptographic nonces, order keys, or user capabilities. By supplying arbitrary numeric order IDs, an attacker can force orders into a cancelled or failed state.\nThis unauthorized modification triggers unintended downstream side-effects, including the automated release of inventory stock and the dispatch of cancellation or failure notifications to customers and administrators.\nThe risk implication is significant, as malicious actors can cause widespread operational disruption, inventory desynchronization, and Denial of Service (DoS) conditions for e-commerce platforms utilizing the affected plugin.\nExploitation requires no authentication or privileges, relying solely on network accessibility to the public payment return endpoints and the sequential enumeration of numeric order identifiers.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of state-changing operations within the public payment cancel and fail return URLs implemented by the Tamara Checkout WordPress plugin through version 1.9.9.20.\nThe vulnerable component lacks essential access controls and validation mechanisms. Specifically, the endpoints do not verify the WooCommerce order key, validate a cryptographic nonce, or check the capability of the entity initiating the request.\nAuthentication and privilege requirements are entirely absent, allowing unauthenticated attackers over the network to interact directly with the vulnerable return endpoints.\nThe exploitation method relies on supplying an attacker-controlled numeric order ID via the insecure request parameters. Because the application trusts the supplied identifier without verifying ownership or cryptographic proof, it processes the state change for the targeted transaction.\nThe attack flow proceeds as follows: First, the attacker identifies or enumerates valid numeric order IDs present within the WooCommerce database of the target store. Second, the attacker crafts malicious HTTP requests directed at the public payment cancel or fail return URLs, injecting the targeted numeric order IDs. Third, the plugin processes the requests and updates the corresponding WooCommerce order status to cancelled or failed.\nUpon successful status transition, the post-exploitation impact triggers automated WooCommerce hooks. These hooks execute downstream business logic, resulting in the premature release of reserved stock back into active inventory and the transmission of notification emails to customers and merchants.\nBecause the vulnerability permits mass enumeration of sequential numeric IDs, an attacker can systematically compromise store-wide transaction integrity, resulting in severe operational disruption and financial impact."
}