EUVD-2026-58597
GHSA-wqwq-hmg7-q93r
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable unauthenticated endpoint, but AC:H reflects prerequisite order-ID knowledge; no confidentiality or availability impact applies.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
AnalysisAI
Order integrity bypass in the Epeken All Kurir for Woocommerce WordPress plugin (≤2.1.2) allows unauthenticated network attackers to mark arbitrary orders as confirmed - and, under non-default payment configurations, as paid - without owning the order or completing a real transaction. The plugin's payment-confirmation handler performs no origin check and no actual payment verification, making it possible for an adversary to fraudulently trigger fulfillment workflows. No public exploit code has been identified at time of analysis, and EPSS sits at 0.15% (4th percentile), indicating low observed exploitation probability despite the unauthenticated network vector.
Technical ContextAI
The Epeken All Kurir for Woocommerce plugin integrates Indonesian courier services with WooCommerce, the e-commerce layer of WordPress. The flaw is classified under CWE-287 (Improper Authentication): the plugin exposes a payment-confirmation endpoint (likely a webhook receiver or AJAX handler) that accepts state-changing requests without verifying that the caller is the legitimate order owner or that any financial transaction actually took place. This is a classic broken object-level authorization (BOLA/IDOR) combined with missing payment-proof validation. Affected CPE is the plugin at all versions through 2.1.2. The CVSS AC:H metric suggests that successful exploitation requires knowledge of a specific order identifier, which an attacker would need to discover or enumerate before targeting a victim order.
RemediationAI
No vendor-released patched version has been independently confirmed in the available intelligence data; the WPScan advisory (https://wpscan.com/vulnerability/b66b86f9-e49e-4654-84a1-0f2e5c859289/) should be monitored for an updated plugin release beyond version 2.1.2. As an immediate compensating control, merchants should disable or restrict access to the plugin's payment-confirmation endpoint at the web server or firewall level - for example, blocking unauthenticated POST requests to the relevant AJAX action or REST route identified in the plugin source. Alternatively, temporarily deactivating the Epeken All Kurir plugin and relying on manual shipping confirmation eliminates the attack surface with the trade-off of added operational overhead. Merchants should also audit recent order histories for anomalous confirmation state changes. If a non-default payment configuration is in use that allows the paid-status bypass, reverting to default WooCommerce payment handling provides an additional layer of protection until a patch is available.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today