Tamara Checkout
Monthly
Missing authorization on the Tamara Checkout WordPress plugin's public payment cancel/fail return URLs allows any unauthenticated remote attacker to cancel or fail arbitrary WooCommerce orders store-wide simply by enumerating sequential numeric order IDs. The plugin through version 1.9.9.20 performs no verification of the WooCommerce order key, a WordPress nonce, or any user capability before acting on the supplied ID, making mass order disruption trivial to automate. A publicly available exploit has been documented by WPScan; no KEV listing is present but the low-friction attack surface warrants prompt remediation.
Missing authorization on the Tamara Checkout WordPress plugin's public payment cancel/fail return URLs allows any unauthenticated remote attacker to cancel or fail arbitrary WooCommerce orders store-wide simply by enumerating sequential numeric order IDs. The plugin through version 1.9.9.20 performs no verification of the WooCommerce order key, a WordPress nonce, or any user capability before acting on the supplied ID, making mass order disruption trivial to automate. A publicly available exploit has been documented by WPScan; no KEV listing is present but the low-friction attack surface warrants prompt remediation.