The vulnerability allows an attacker to invoke the REST API endpoint /wp-json/strabl/webhook/order without any authentication, enabling the creation of fraudulent WooCommerce orders, manipulation of order status, and automatic refunds or chargebacks. Without requiring a legitimate payment or credentials, the attacker can also generate WordPress user accounts with the customer role. This results in severe integrity and financial loss to the merchant, and may expose sensitive user data if the forged orders contain personal information.

The affected product is the STRABL – A checkout solution plugin for WordPress, maintained by strablengineering. All releases up to and including version 4.5 are vulnerable. Systems running any of those versions with the REST endpoint exposed to external traffic are at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet have known public exploitation. Nonetheless, the attack vector is easily exercised via the unauthenticated REST endpoint, making exploitation straightforward for any attacker with network access to the site. The lack of authentication or signature checks qualifies the weakness as Missing Authorization (CWE‑862).