The Appmax WordPress plugin lacks proper input validation and authentication for its REST API webhook endpoint, allowing attackers to send forged requests that are processed as legitimate. This flaw enables malicious actors to change the status of existing WooCommerce orders, create new orders with arbitrary data, add new products with attacker‑controlled attributes, and inject arbitrary metadata into orders. The immediate consequence is the potential for financial fraud, unauthorized refunds, and compromise of order integrity, directly affecting the confidentiality and integrity of the e‑commerce system.

All installations of the Appmax plugin for WordPress through version 1.0.3 are affected. The vendor and product are Appmax. No impacted sub‑products or specific WordPress versions are identified beyond the plugin itself.

With a CVSS score of 5.3, the vulnerability is considered medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The lacking authentication means that an unauthenticated remote attacker can simply POST to the /webhook-system endpoint with crafted payloads; no additional conditions or system privileges are required. Because of the remote nature of the exploit, the risk is moderate, though the potential impact on business operations and revenue can be significant.