CVE-2026-3640: 
WordPress vulnerability analysis and mitigation

CVE-2026-3640 is a Missing Authentication vulnerability in the STRABL – A Checkout Solution plugin for WordPress, affecting all versions up to and including 4.5. The plugin exposes a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback of __return_true, allowing completely unauthenticated access. It was published on June 19, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization). The plugin's OrderWebhookController.php registers the /wp-json/strabl/webhook/order REST API endpoint with WordPress's __return_true as its permission callback, meaning no authentication or authorization is enforced on any incoming request. No shared secret, HMAC signature verification, or token-based authentication is implemented at any point in the request handling logic. Relevant vulnerable code paths are documented in OrderWebhookController.php at lines 60, 64, 88, 199, and 550, as well as CustomerRepository.php at line 17 (GitHub Advisory).

An unauthenticated remote attacker can abuse the unprotected webhook endpoint to create fraudulent WooCommerce orders and mark them as paid (via paymentStatus=paid), manipulate existing order statuses using an externalOrderId, create new WordPress user accounts with the customer role, issue refunds on legitimate orders, cancel existing orders, and apply chargeback fees — all without making any legitimate payment or possessing valid credentials. The primary impact is on integrity (financial fraud, order manipulation, unauthorized account creation), with no direct confidentiality or availability impact (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the STRABL – A Checkout Solution plugin (versions ≤ 4.5) using tools like WPScan, Shodan, or by checking /wp-content/plugins/strabl-a-checkout-solution/ for plugin presence.
2. Confirm endpoint availability: Send a GET or POST request to https://[target]/wp-json/strabl/webhook/order to confirm the endpoint is accessible without authentication (HTTP 200 response indicates vulnerability).
3. Create fraudulent paid order: Send a crafted POST request to the endpoint with a JSON body including paymentStatus=paid and relevant order details to create a WooCommerce order marked as completed without payment.
4. Manipulate existing orders: Supply a known or guessed externalOrderId in the POST body to alter the status of an existing order (e.g., trigger a refund or cancellation).
5. Create user accounts: Craft a request that triggers the customer account creation logic in CustomerRepository.php, registering a new WordPress user with the customer role for persistent access or further abuse (GitHub Advisory).

• Network: Unexpected POST requests to /wp-json/strabl/webhook/order from unknown or external IP addresses not associated with the legitimate STRABL payment provider.
• Logs: WordPress/web server access logs showing repeated or anomalous requests to the /wp-json/strabl/webhook/order endpoint, especially with paymentStatus=paid or externalOrderId parameters from untrusted sources.
• WooCommerce: Sudden appearance of orders marked as "completed" or "paid" with no corresponding legitimate payment transaction; unexpected refunds or cancellations on existing orders; chargeback fees applied without a corresponding payment dispute.
• User Accounts: New WordPress user accounts with the customer role created at unusual times or in bulk, not corresponding to legitimate customer registrations (GitHub Advisory).

Site administrators should update the STRABL plugin to a version newer than 4.5 that implements proper authentication for the webhook endpoint; a patch was made available on June 19, 2026 (changeset 3558301 in the WordPress plugin repository). As an interim workaround, implement a Web Application Firewall (WAF) rule to restrict access to /wp-json/strabl/webhook/order to known, legitimate STRABL payment provider IP addresses only. Additionally, administrators should audit recent WooCommerce orders, refunds, and newly created user accounts to identify any fraudulent activity that may have occurred prior to patching (GitHub Advisory).

Wordfence included CVE-2026-3640 in its weekly WordPress vulnerability report for the period of June 15–21, 2026, flagging it as a notable missing authentication issue in the STRABL plugin. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified for this CVE.