CVE-2026-3640: STRABL WordPress Auth Bypass Vulnerability

CVE-2026-3640 Overview

CVE-2026-3640 affects the STRABL – A checkout solution plugin for WordPress in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback of __return_true, allowing every incoming request to bypass authentication. The endpoint lacks shared secrets, HMAC signature validation, and token-based authentication. Unauthenticated attackers can create fraudulent WooCommerce orders marked as paid, manipulate order statuses, register customer-role user accounts, issue refunds, cancel orders, and apply chargeback fees. The flaw is tracked as CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can manipulate WooCommerce order states, generate fraudulent paid orders, and create WordPress accounts without valid credentials or payment.

Affected Products

STRABL – A checkout solution plugin for WordPress
All versions up to and including 4.5
WooCommerce-integrated WordPress sites running the plugin

Discovery Timeline

2026-06-19 - CVE-2026-3640 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-3640

Vulnerability Analysis

The STRABL plugin exposes a REST API webhook designed to receive order status callbacks from the STRABL checkout service. The route registration assigns __return_true as the permission_callback, which unconditionally approves every request. No signature verification, IP allowlist, or shared secret check exists in the controller logic. The endpoint processes order-state mutations directly from request parameters such as paymentStatus and externalOrderId.

This design turns a server-to-server webhook into a publicly invokable order management API. Attackers can transition orders to completed by supplying paymentStatus=paid, target existing transactions through externalOrderId, and trigger customer account creation through the same controller. The resulting impact maps to integrity loss on WooCommerce data and downstream financial reconciliation.

Root Cause

The root cause is a missing authorization control on a state-changing REST route. The OrderWebhookController registers its endpoint with a permission callback that returns true for every caller. The companion CustomerRepository accepts customer creation requests originating from the same unauthenticated route. Without cryptographic validation of webhook origin, the controller treats attacker-supplied JSON as trusted STRABL data.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker sends a crafted HTTP POST request to /wp-json/strabl/webhook/order containing JSON fields that drive order and customer mutations. No user interaction is required. Because the endpoint is exposed by default once the plugin is active, any internet-reachable WordPress site running STRABL ≤ 4.5 is in scope. See the Wordfence Vulnerability Report and the relevant code in OrderWebhookController.php line 60.

No verified proof-of-concept code is published. The vulnerability mechanism is documented in the plugin source at OrderWebhookController.php line 199 and CustomerRepository.php line 17.

Detection Methods for CVE-2026-3640

Indicators of Compromise

Unexpected HTTP POST requests to /wp-json/strabl/webhook/order from non-STRABL source IP addresses.
WooCommerce orders transitioning to completed without a matching payment gateway transaction record.
New WordPress users with the customer role created without corresponding checkout session logs.
Unexplained refund, cancellation, or chargeback fee entries in WooCommerce order history.

Detection Strategies

Inspect web server access logs for POST requests to the strabl/webhook/order route and correlate against the legitimate STRABL provider IP ranges.
Compare WooCommerce order status changes against payment gateway settlement reports to identify orders marked paid without gateway confirmation.
Audit the WordPress users table for accounts created outside expected checkout flows and review the registration timestamp against webhook traffic.

Monitoring Recommendations

Enable verbose REST API logging for the strabl/* namespace and forward events to a centralized SIEM for correlation.
Alert on bursts of order status transitions or customer account creations originating from the webhook endpoint.
Monitor for HTTP 200 responses on the webhook route from previously unseen client IP addresses.

How to Mitigate CVE-2026-3640

Immediate Actions Required

Update the STRABL – A checkout solution plugin to a version later than 4.5 once the vendor publishes a patched release.
If no patched version is available, deactivate and remove the plugin until a fix is released.
Review WooCommerce orders, refunds, and user accounts created since the plugin was installed to identify fraudulent activity.

Patch Information

The plugin repository contains Changeset #3558301 addressing the webhook controller. Site operators should confirm the deployed plugin version reflects this changeset and verify the permission_callback is no longer __return_true. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

Restrict access to /wp-json/strabl/webhook/order at the web application firewall or reverse proxy, allowing only STRABL provider IP ranges.
Block unauthenticated POST requests to the STRABL REST namespace using a WAF rule until the plugin is patched.
Disable the plugin on sites that do not actively process STRABL checkouts.

bash

# Example nginx restriction for the STRABL webhook endpoint
location = /wp-json/strabl/webhook/order {
    allow 203.0.113.0/24;   # Replace with STRABL provider range
    deny all;
    proxy_pass http://wordpress_backend;
}