UNKNOWN NVD

CVE-2026-16739

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targete

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.

References

https://wpscan.com/vulnerability/b66b86f9-e49e-4654-84a1-0f2e5c859289/

Published: 2026-08-14 · Source: NVD · Feed updated: 2026-08-14

This unknown severity vulnerability was published on 2026-08-14 via NVD.

vulnfeed aggregates 11029 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.