Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint
mediumThe Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a public REST API webhook endpoint at /webhook-system without implementing webhook signature validation, secret verification, or any mechanism to authenticate tha...
- CVSS:
- 5.3
- Affected:
- up to 1.0.3
- Fix:
- No patched version reported
- Disclosed:
- Mar 20, 2026