CVE-2026-3640

Name of the Vulnerable Software and Affected Versions STRABL – A checkout solution plugin for WordPress versions prior to 4.6

Description The plugin contains a missing authentication flaw in the REST API webhook endpoint "/wp-json/strabl/webhook/order". The endpoint uses a permission callback set to return true, allowing all requests to bypass authentication and authorization checks. Because there is no shared secret, signature validation, HMAC verification, or token-based authentication, unauthenticated users can perform several unauthorized actions. These include creating fraudulent WooCommerce orders and marking them as completed by setting the paymentStatus variable to paid, manipulating order statuses via the externalOrderId variable, creating new WordPress user accounts with the customer role, issuing refunds, cancelling orders, and applying chargeback fees.

Recommendations Update the plugin to a version later than 4.5. As a temporary workaround, restrict access to the "/wp-json/strabl/webhook/order" endpoint to minimize the risk of exploitation.