The Tamara Checkout WordPress plugin allows an unauthenticated attacker to change a WooCommerce order’s status by supplying only a numeric order id. Because the plugin does not validate the order key, nonce, or user capabilities on its public cancel or fail return URLs, an attacker can instruct the system to cancel or fail any order. This action triggers downstream effects such as automatic stock release and order notification emails, potentially impacting inventory accuracy and customer experience. The weakness stems from improper authorization control, enabling unauthorized order manipulation without authentication. Affected System(s) The vulnerability affects the Tamara Checkout plugin for WordPress, version 1.9.9.20 and earlier. Users running any of these versions are exposed to the risk of order status tampering. Risk and Exploitability The CVSS score is not provided, but the potential impact on order integrity and inventory is significant. The EPSS score is unavailable, and the vulnerability is not yet listed in CISA’s KEV catalog. However, the lack of proper validation means an attacker can enumerate order identifiers through brute‑force or other means, making exploitation feasible without authentication. The attack vector is an unauthenticated request to the public payment cancel/fail URLs, potentially abuseable by anyone with network access to the site.

Tamara Checkout WordPress plugin versions 1.9.9.20 and earlier.

Attackers can manipulate order statuses without authentication, with the risk highly dependent on the ability to enumerate order IDs. Even though no public exploits are documented, the straightforward nature of the flaw and the consequential side‑effects make it a high‑value target.