CVE-2026-16962

The CVSS 5.3 score for this vulnerability badly misrepresents the actual risk. The rating treats order status manipulation as a modest information disclosure, but the real weapon is the automatic stock-release cascade that enumerating order IDs triggers. Every successful ID hit—obtained through trivial sequential scanning—releases held inventory without requiring any authentication, nonce, or confirmation that the caller owns the order. The enumeration requirement is not a meaningful barrier. Sequential numeric IDs in WooCommerce mean an attacker gets a predictable target set without needing to discover what's valuable. Running a script for sixty seconds yields valid order IDs, and each one instantly triggers the full downstream chain: stock released back to available inventory, order state changed, customer notification sent, fulfillment queue potentially corrupted. You are not defending against one vulnerability—you are defending against one vulnerability that auto-fires three others with zero additional effort from the attacker. The upstream cause matters for remediation. WooCommerce's payment return URL pattern was never designed as an access control boundary—it exists because third-party payment servers cannot carry session cookies. The order-key mechanism is a stateless routing token, not an authorization credential. Plugin developers inherit this pattern and frequently treat it as both routing mechanism and security boundary, which is the category error producing this class of flaw. Check whether your payment gateway integrations validate order-key ownership on public callbacks, not just use the key for routing. For defenders: scan your WooCommerce deployments for plugins handling payment callbacks that don't explicitly validate the order belongs to the requesting party. Monitor for sudden spikes in order status changes from non-authenticated sources, inventory discrepancies between held and available stock, and customer support tickets about orders that changed without user action. The attack generates noise—500 cancelled orders means 500 customer inquiries within hours—but the damage to inventory integrity can happen before anyone notices. The vulnerability is severe not because of what the API does in isolation, but because WooCommerce's hook architecture bundles stock release, notifications, and fulfillment state into a single atomic operation triggered by a public endpoint with no ownership check.

Reviewed through automated stages and approved by a human before publication.