CVE-2026-16739 in Epeken All Kurir for Woocommerce Plugin
Summary
by MITRE • 08/14/2026
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The Epeken All Kurir for Woocommerce WordPress plugin version 2.1.2 contains a critical authorization vulnerability that fundamentally undermines the security of payment confirmation processes within WooCommerce environments. This vulnerability stems from the plugin's complete absence of authentication verification mechanisms when processing payment confirmation requests, creating a pathway for unauthenticated attackers to manipulate order states without proper authorization.
The technical flaw resides in the plugin's failure to implement proper request validation and user authentication checks before accepting payment confirmation signals. When a payment confirmation request is received, the system does not verify whether the requesting party has legitimate ownership rights over the targeted order or whether actual payment processing has occurred. This lack of verification creates a condition where any attacker with knowledge of an order identifier can manipulate the order status to reflect payment confirmation, regardless of their authorization level or actual payment status.
This vulnerability directly maps to CWE-862, which addresses insufficient authorization checks, and represents a significant weakness in the principle of least privilege enforcement. The operational impact of this flaw extends beyond simple order manipulation, as it allows attackers to potentially bypass payment verification systems entirely. In non-default configurations where automatic payment marking is enabled, attackers can effectively mark any arbitrary order as paid, enabling them to circumvent the entire payment processing workflow and potentially gain unauthorized access to products or services associated with those orders.
The security implications are particularly severe in e-commerce environments where payment confirmation directly affects inventory management, shipping processes, and revenue tracking. Attackers could exploit this vulnerability to mark fraudulent orders as paid, create false revenue records, or manipulate order fulfillment workflows. The attack surface is further expanded because the vulnerability does not require authentication credentials or privileged access, making it particularly dangerous for systems that rely on the plugin's payment confirmation mechanisms.
Mitigation strategies should include immediate implementation of proper authentication verification before accepting any payment confirmation requests, enforcement of order ownership validation through cryptographic signatures or session-based authentication, and ensuring that payment status changes are only accepted from verified payment processors. Organizations should also implement monitoring and logging mechanisms to detect unauthorized order status modifications and establish proper access controls for plugin configuration settings. The vulnerability demonstrates the critical importance of implementing robust authorization checks in payment processing components and aligns with ATT&CK technique T1078 which addresses valid accounts usage for persistence and privilege escalation within compromised systems.