Missing Authentication Vulnerability in STRABL Checkout Solution Plugin for WordPress

CVE-2026-3640

What is CVE-2026-3640?

The STRABL plugin for WordPress, a checkout solution, is susceptible to a missing authentication vulnerability, allowing unauthorized access to a REST API endpoint. This weakness enables attackers to send unverified requests, executing a range of harmful actions such as creating fraudulent WooCommerce orders, altering existing order statuses, registering new WordPress user accounts, processing refunds, canceling orders, and imposing chargebacks without valid credentials or legitimate payment. The absence of authentication mechanisms, such as shared secrets or token-based verification, significantly raises the risk of exploitation.

References