CVE-2026-3640 describes a missing authorization vulnerability (CWE-862) in the STRABL – A checkout solution WordPress plugin. The plugin exposes a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback set to __return_true, effectively disabling any authentication or authorization checks. No mechanisms such as shared secrets, signature validation, HMAC verification, or token-based authentication are implemented. This flaw allows unauthenticated attackers to perform multiple unauthorized actions including creating and completing fraudulent WooCommerce orders, modifying existing orders, creating new WordPress user accounts with customer privileges, issuing refunds, canceling orders, and applying chargeback fees.

The vulnerability allows unauthenticated attackers to manipulate WooCommerce orders and user accounts without any valid credentials or payment. This can lead to fraudulent transactions, unauthorized refunds, order cancellations, and creation of unauthorized user accounts with customer roles. While it does not impact confidentiality, it affects the integrity of order and user data, potentially causing financial loss and operational disruption for affected e-commerce sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the affected REST API endpoint by implementing custom authentication or authorization controls, such as requiring valid tokens or IP whitelisting. Monitor for unusual order activity and consider disabling the webhook endpoint if not in use.