STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
mediumThe STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback of __return_true, which allows all incoming requests without any authenticat...
- CVSS:
- 5.3
- Affected:
- up to 4.5
- Fixed in:
- 4.6
- Disclosed:
- Jun 18, 2026