Junglewise Threat Intelligence

CVE-2026-3640: STRABL A checkout solution missing authentication in REST API webhook

CVE-2026-3640 · Severity: medium · CVSS 5.3 · Published 2026-06-19

Executive brief

The STRABL checkout plugin for WordPress, which handles e-commerce payments and order processing, contains a security flaw that allows anyone to bypass authentication. An attacker can use this to create fake orders, mark unpaid orders as paid, issue unauthorized refunds, or create new user accounts. This could lead to significant financial loss, inventory discrepancies, and fraudulent transactions on affected online stores.

Technical details

The STRABL plugin for WordPress fails to implement authentication or authorization on its REST API webhook endpoint located at /wp-json/strabl/webhook/order. The endpoint uses a permission_callback that always returns true, and it lacks any secondary verification such as HMAC signatures, shared secrets, or tokens. By sending crafted requests to this endpoint, a remote, unauthenticated attacker can manipulate order statuses (e.g., setting paymentStatus to 'paid'), trigger refunds, cancel orders, or create new WordPress users with the 'customer' role. The vulnerability is present in all versions up to and including 4.5.

Affected products

  • strablengineering STRABL – A checkout solution up to and including 4.5

Timeline

  • 2026-06-19: advisory: NVD publication date

References