CVE-2026-16739

The CVE concerns the Epeken All Kurir for Woocommerce WordPress plugin up to version 2.1.2. It states that the plugin does not verify that a payment-confirmation request originates from the order owner, nor that a payment actually occurred, which could let unauthenticated attackers mark arbitrary...