CVE-2026-16739

The 5.9 CVSS on CVE-2026-16739 badly undersells the risk. This IDOR in the Epeken plugin (WooCommerce-Indonesian courier integration) allows unauthenticated attackers to forge payment confirmations on any order by manipulating the order ID. The EPSS of 0.00221 reflects the plugin's niche footprint in Indonesian logistics, not the severity of what's possible when exploitation succeeds. The critical distinction is between "confirmed" and "paid" status. The plugin offers both as configuration options, and "paid" status is what matters: in automated fulfillment workflows, payment confirmation triggers inventory reservation, shipping initiation, and customer notifications. When an attacker can inject false "paid" signals without owning the order, automated systems act on fabricated financial data. That means inventory deduction, shipment processing, and courier handoffs all fire without any actual payment received. This vulnerability enables scalable exploitation. The unauthenticated endpoint accepts direct order ID manipulation with no rate limiting, no account validation, and no lockout triggers. If WooCommerce order IDs are sequential or predictable within a merchant instance—which you should verify immediately—an attacker can script confirmation requests across a merchant's entire order history in seconds. One forged confirmation is a bug; automated mass-forgery against a merchant's active orders is financial fraud at scale. The cascade extends beyond the merchant. Couriers process shipments based on payment-confirmation signals. Customers receive goods they didn't pay for. Chargebacks, return fraud, and courier claims all compound the initial loss. The merchant absorbs the direct cost, but three or four downstream parties have now acted on corrupted trust data. Check two things immediately: first, whether the "paid" status configuration is enabled in your Epeken installation—if it is, disable automated fulfillment triggers tied to payment confirmation until patched. Second, inspect your order ID generation—if IDs are sequential, treat this as a high-priority incident because automated enumeration is trivially achievable. The CVSS is medium; the actual business impact is limited only by how much automation you've built on top of payment-confirmation signals.

Reviewed through automated stages and approved by a human before publication.