CVE-2026-16739 — Epeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation Forgery
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that…
Published: 2026-08-14 · CVSS: 5.9 · CVSS 3.1
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7