CVE-2026-3640: STRABL WordPress Plugin Missing Authentication in Webhook Endpoint

Technical summary

CVE-2026-3640 is a missing authentication vulnerability in the STRABL WordPress plugin's webhook handler. The endpoint /wp-json/strabl/webhook/order is registered with permission_callback set to __return_true, which unconditionally permits all requests. The endpoint processes order data including paymentStatus, externalOrderId, customer details, and refund/cancellation instructions with no signature validation, HMAC verification, shared secret checking, or token-based authentication. An attacker can submit arbitrary JSON payloads to this endpoint to create, modify, or cancel orders and user accounts within the associated WooCommerce store.

Business impact

Websites using this plugin face direct financial and operational risk. Attackers can generate fraudulent completed orders without payment, eroding revenue and inventory accuracy. Unauthorized refunds and chargebacks increase financial loss and payment processor penalties. Creation of unauthorized user accounts may enable secondary attacks or access to customer data. Order and customer data integrity is compromised, undermining business intelligence and customer trust. E-commerce operations relying on order accuracy become unreliable, potentially triggering fulfillment of unpaid orders.

Affected systems

All WordPress installations running the STRABL checkout solution plugin in version 4.5 or earlier are affected. The vulnerability is present in the core webhook functionality and does not depend on specific WordPress versions, WooCommerce versions, or server configurations—only that the plugin is installed and activated. Any site with this plugin exposed to the internet is at risk.

Exploitability

Exploitability is very high. No authentication or special configuration is required; the vulnerable endpoint is publicly accessible by default and accepts requests from any source. An attacker needs only to craft HTTP POST requests with valid JSON payloads—no valid payment credentials, admin access, or legitimate customer account is necessary. The barrier to exploitation is minimal, making this a trivial attack for any threat actor with basic HTTP knowledge. The CVSS score of 5.3 reflects that the integrity impact is limited to order data within the application scope, but the ease of exploitation and lack of any protective mechanism warrant urgent attention.

Remediation

Update the STRABL plugin to a version that implements proper authentication on the webhook endpoint. Verify that updates released after June 22, 2026 (the modification date) address this issue by adding HMAC signature validation, shared secret verification, IP allowlisting, or token-based authentication. If no patch is available, disable or remove the plugin until a secure version is released. As an interim mitigation, use a Web Application Firewall (WAF) to block requests to /wp-json/strabl/webhook/order from untrusted sources, though this is not a substitute for a proper fix.

Patch guidance

Check the STRABL plugin vendor's advisory and update history for versions released after June 22, 2026. Apply the latest available version that addresses CVE-2026-3640. Before deploying, test the update in a staging environment to ensure WooCommerce order processing and webhook handling remain functional. Verify that the webhook endpoint now requires proper authentication by attempting an unauthenticated request and confirming it is rejected. Document the patch version applied for audit and compliance records.

Detection guidance

Monitor web server and WAF logs for requests to /wp-json/strabl/webhook/order from unexpected sources or with suspicious payloads. Look for POST requests containing 'paymentStatus=paid', 'externalOrderId', or refund/cancel actions in the request body. Alert on multiple consecutive requests in a short timeframe, which may indicate automated exploitation. Review WooCommerce order logs for orders marked as completed without corresponding payment gateway records. Check user creation logs for unexpected customer accounts created around times of suspicious webhook activity. Correlate timing of suspicious webhook requests with unexplained order status changes or refunds.

Why prioritize this

Although the CVSS score is 5.3 (MEDIUM), the practical impact justifies higher prioritization for any organization running the STRABL plugin. The vulnerability requires zero authentication, zero user interaction, and grants direct financial manipulation capability. The combination of easy exploitability and clear business harm (fraudulent orders, unauthorized refunds, unauthorized account creation) makes this a 'must patch immediately' issue for affected e-commerce sites. Any e-commerce operation relying on accurate order and payment data should treat this as a critical operational risk.

Risk score, explained

The CVSS 3.1 score of 5.3 is derived from attack vector network (AV:N), attack complexity low (AC:L), privilege required none (PR:N), user interaction none (UI:N), scope unchanged (S:U), confidentiality impact none (C:N), integrity impact low (I:L), and availability impact none (A:N). The score reflects that the vulnerability is remotely exploitable with no preconditions, but that the scope of impact is limited to integrity of order data within the application boundary, with no confidentiality or availability loss in the CVSS model. However, for e-commerce applications, integrity compromise of order and payment data carries outsized business risk not fully captured by the numeric score.

Frequently asked questions