CVE-2026-16739
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Epeken All Kurir for WooCommerce plugin through version 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
Risk Assessment
An attacker can confirm orders without making a payment, leading to financial losses for the store. This can also compromise the integrity of the order process.
Recommendation
Update the Epeken All Kurir plugin to the latest version that includes security fixes. Check that the configuration does not allow marking orders as paid without verification.
Original NVD description (English source)
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.