CyberRota Analysis
AI-GeneratedThe Tamara Checkout plugin for WordPress versions up to 1.9.9.20 is vulnerable due to inadequate verification of order keys and nonces on public payment cancel/fail return URLs. This allows unauthenticated attackers to manipulate WooCommerce order statuses by supplying arbitrary numeric order IDs, potentially leading to unauthorized cancellations and stock management issues. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).