What is the CVSS score of CVE-2026-3641?

CVE-2026-3641 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3641?

Organizations using for WordPress is vulnerable to Improper Input Validation in all should be aware of moderate risk from CVE-2026-3641, a input validation vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-3641?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Improper Input Validation in and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-3641

EUVD-2026-14187 MEDIUM

Improper Input Validation (CWE-20)

2026-03-21 Wordfence

GHSA-crgh-3rc5-vq96

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14187

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a public REST API webhook endpoint at /webhook-system without implementing webhook signature validation, secret verification, or any mechanism to authenticate that incoming webhook requests genuinely originate from the legitimate Appmax payment service. The plugin directly processes untrusted attacker-controlled input from the 'event' and 'data' parameters without verifying the webhook's authenticity. This makes it possible for unauthenticated attackers to craft malicious webhook payloads that can modify the status of existing WooCommerce orders (e.g., changing them to processing, refunded, cancelled, or pending), create entirely new WooCommerce orders with arbitrary data, create new WooCommerce products with attacker-controlled names/descriptions/prices, and write arbitrary values to order post metadata by spoofing legitimate webhook events.

AnalysisAI

The Appmax WordPress plugin versions up to 1.0.3 contain an improper input validation vulnerability in its public REST API webhook endpoint at /webhook-system that fails to authenticate, verify signatures, or validate the authenticity of incoming webhook requests. Unauthenticated attackers can exploit this by crafting malicious webhook payloads to modify existing WooCommerce order statuses, create arbitrary new orders and products with attacker-controlled data, and inject arbitrary metadata into orders. With a CVSS score of 5.3 (medium severity), an CVSS vector indicating network accessibility with low attack complexity and no authentication required, and confirmed vulnerability references in the official WordPress plugin repository, this vulnerability poses a significant integrity risk to e-commerce sites using the affected plugin.

Technical ContextAI

The vulnerability stems from a failure to implement CWE-20 (Improper Input Validation) in the Appmax plugin's webhook handling mechanism. The plugin registers an unauthenticated public REST API endpoint at /webhook-system (as referenced in class-appmax-payments-webhook.php) that accepts and processes webhook events without implementing any of the standard webhook security mechanisms: HMAC signature validation, shared secret verification, or request origin authentication. The vulnerability affects the payment webhook event processing chain in class-appmax-payments-webhook-events.php and order payment handlers in class-appmax-payments-order-paid.php, which directly consume attacker-supplied 'event' and 'data' parameters and apply them to WooCommerce order and product objects without validation. The affected product is identified by CPE 2.3:a:appmaxplataforma:appmax:*:*:*:*:*:*:*:* covering all versions through 1.0.3, and the plugin integrates directly with WooCommerce order and product post types via WordPress REST API.

RemediationAI

Immediately disable or uninstall the Appmax plugin if not in active use, or contact the plugin vendor (Appmax Plataforma) for a patched version newer than 1.0.3 that implements HMAC signature validation and webhook secret verification. Until a patch is available, implement a network-level mitigations: add a Web Application Firewall (WAF) rule to block POST requests to /wp-json/appmax/*/webhook-system from unauthorized IP ranges, or restrict this endpoint to a whitelist of known Appmax payment service IP addresses if the vendor publishes them. Additionally, monitor WooCommerce order and product creation logs for suspicious activity and consider using a reverse proxy or WordPress security plugin to enforce strict rate limiting on all webhook endpoints. Consult Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf61bb7-f977-4afe-bb81-e6de12e00b03?source=cve for vendor security contact information and any available patches.