The Tamara Checkout WordPress plugin allows an unauthenticated attacker to change a WooCommerce order’s status by supplying only a numeric order id. Because the plugin does not validate the order key, nonce, or user capabilities on its public cancel or fail return URLs, an attacker can instruct the system to cancel or fail any order. This action triggers downstream effects such as automatic stock release and order notification emails, potentially impacting inventory accuracy and customer experience. The weakness stems from improper authorization control, enabling unauthorized order manipulation without authentication.

Tamara Checkout WordPress plugin versions 1.9.9.20 and earlier.

Attackers can manipulate order statuses without authentication, with the risk dependent on the ability to enumerate order IDs. The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of < 1% suggests a low likelihood of exploitation, but the vulnerability is not listed in CISA KEV. Even though no public exploits are known, the straightforward nature of the flaw and its side‑effects make it a high‑value target.