strablengineering STRABL Plugin up to 4.5 on WordPress REST API Webhook Endpoint order __return_true authorization

Summaryinfo

A vulnerability identified as critical has been detected in strablengineering STRABL Plugin up to 4.5 on WordPress. Affected by this vulnerability is the function __return_true of the file /wp-json/strabl/webhook/order of the component REST API Webhook Endpoint. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2026-3640. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in strablengineering STRABL Plugin up to 4.5 on WordPress. This affects the function __return_true of the file /wp-json/strabl/webhook/order of the component REST API Webhook Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback of __return_true, which allows all incoming requests without any authentication or authorization checks. No shared secret, signature validation, HMAC verification, or token-based authentication is implemented. This makes it possible for unauthenticated attackers to create fraudulent WooCommerce orders and mark them as completed by supplying paymentStatus=paid, manipulate existing order statuses by providing an externalOrderId, create new WordPress user accounts with the customer role, issue refunds on existing orders, cancel existing orders, and apply chargeback fees — all without making a legitimate payment or having any valid credentials.

The weakness was shared by Teerachai Somprasong. It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2026-3640 since 03/06/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37995). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• strablengineering

Name

• STRABL Plugin

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion