CVE-2026-3640 | strablengineering STRABL Plugin up to 4.5 on WordPress REST API Webhook Endpoint order __return_true authorization (EUVD-2026-37995)

June 19, 2026 Yanac

A vulnerability categorized as critical has been discovered in strablengineering STRABL Plugin up to 4.5 on WordPress. Affected is the function __return_true of the file /wp-json/strabl/webhook/order of the component REST API Webhook Endpoint. Such manipulation leads to missing authorization.

This vulnerability is listed as CVE-2026-3640. The attack may be performed from remote. There is no available exploit.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More