What is the CVSS score of CVE-2026-3640?

CVE-2026-3640 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.4%.

STRABL WordPress Plugin CVE-2026-3640

EUVD-2026-37995 MEDIUM

Missing Authorization (CWE-862)

2026-06-19 Wordfence

GHSA-v9cf-wxpg-292v

WordPress Authentication Bypass Wordpress Plugin Strabl A Checkout Solution

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

7.5 HIGH

I:H reflects full order fraud, refund abuse, account creation, and order cancellation - systemic integrity loss beyond partial data modification.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 08:31 vuln.today

CVE Published

Jun 19, 2026 - 06:51 nvd

MEDIUM 5.3

DescriptionCVE.org

The STRABL - A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback of __return_true, which allows all incoming requests without any authentication or authorization checks. No shared secret, signature validation, HMAC verification, or token-based authentication is implemented. This makes it possible for unauthenticated attackers to create fraudulent WooCommerce orders and mark them as completed by supplying paymentStatus=paid, manipulate existing order statuses by providing an externalOrderId, create new WordPress user accounts with the customer role, issue refunds on existing orders, cancel existing orders, and apply chargeback fees - all without making a legitimate payment or having any valid credentials.

AnalysisAI

Unauthenticated REST API webhook manipulation in the STRABL checkout plugin for WordPress (all versions through 4.5) allows any remote attacker to commit payment fraud, manipulate WooCommerce order states, create customer-role user accounts, issue arbitrary refunds, cancel orders, and apply chargeback fees - all without credentials or payment. The root cause is a WordPress REST endpoint registered at /wp-json/strabl/webhook/order with a permission_callback of __return_true, which bypasses all authentication by design. No public exploit code or KEV listing is confirmed at time of analysis, but the vulnerability is trivially exploitable given the open endpoint and well-documented attack surface.

Technical ContextAI

The affected product is the STRABL - A Checkout Solution WordPress plugin by Strablengineering (CPE: cpe:2.3:a:strablengineering:strabl_-_a_checkout_solution:*:*:*:*:*:*:*:*). The plugin integrates with WooCommerce to process orders and register a custom REST API webhook handler in OrderWebhookController.php. WordPress REST API endpoints require a permission_callback function to enforce access control; using the built-in __return_true function unconditionally returns true for all callers, effectively disabling authentication. CWE-862 (Missing Authorization) captures this root cause: the code has no shared secret validation, no HMAC verification, no token-based auth, and no IP allowlisting. The controller methods exposed include order creation (L60/L64), order status mutation (L88), customer account registration (CustomerRepository.php L17), refund processing (L199), and chargeback application (L550), all reachable without any credentials.

RemediationAI

A WordPress plugin repository changeset (changeset 3558301 at plugins.trac.wordpress.org/changeset/3558301) has been committed, representing an upstream code fix; however, a confirmed patched release version has not been independently verified from available data - administrators should check the WordPress plugin directory for a version newer than 4.5 and upgrade immediately upon availability. As an interim compensating control, administrators can add a server-level rule (nginx location block or Apache RewriteRule) to block all external POST requests to /wp-json/strabl/webhook/order, though this will break legitimate payment provider webhook delivery if the plugin is actively processing payments. Alternatively, a WAF rule restricting the endpoint to the IP range of the legitimate payment processor would preserve functionality while blocking arbitrary attackers. Disabling the plugin entirely eliminates the attack surface at the cost of checkout functionality. Do not rely solely on WordPress application-layer controls given the misconfiguration is within the plugin's own code.