CVE-2026-16739 Epeken CVE debrief

Who should care

Administrators and users of the Epeken All Kurir for Woocommerce WordPress plugin, especially those with WooCommerce-based online stores, should be aware of this vulnerability and take necessary defensive actions to prevent unauthorized order modifications.

Technical summary

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 is vulnerable to unauthorized order status modifications. Unauthenticated attackers can mark arbitrary orders as confirmed and, in certain configurations, paid. This is due to a lack of verification for payment-confirmation requests, specifically checking if the request originates from the order owner and if a payment actually occurred. The vulnerability has a CVSS score of 5.9 and a severity of MEDIUM.

Defensive priority

Medium-priority defensive review recommended due to potential for unauthorized order modifications.

Recommended defensive actions

• Review and update the Epeken All Kurir for Woocommerce WordPress plugin to version above 2.1.2
• Implement additional authentication and validation for payment-confirmation requests
• Monitor order status changes for potential unauthorized modifications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from WPScan indicates a vulnerability in the Epeken All Kurir for Woocommerce WordPress plugin. Official CVE and NVD records provide additional context. The vulnerability allows unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.