CVE-2026-3640 describes a missing authorization vulnerability (CWE-862) in the STRABL – A checkout solution WordPress plugin up to version 4.5. The plugin exposes a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback set to __return_true, effectively allowing all incoming requests without authentication or authorization. No mechanisms such as shared secrets, signature validation, HMAC verification, or token-based authentication are implemented. This flaw enables unauthenticated attackers to perform unauthorized operations on WooCommerce orders and WordPress user accounts, including creating fraudulent orders marked as paid, manipulating order statuses, creating new customer accounts, issuing refunds, canceling orders, and applying chargeback fees.

The vulnerability allows unauthenticated attackers to create and manipulate WooCommerce orders and user accounts without any valid credentials or payment. This can lead to financial fraud, unauthorized refunds, order cancellations, and unauthorized user account creation with customer privileges. The integrity of the e-commerce system is compromised, potentially causing revenue loss and operational disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the REST API endpoint via web server rules or firewall policies may reduce exposure. Avoid exposing the vulnerable endpoint publicly and consider disabling the plugin if feasible.