PT-2026-26863 · Automattic+1 · Woocommerce+1

Ronnachai Chaipha + 1 · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2026-3641

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appmax plugin for WordPress versions up to and including 1.0.3

Description The software contains a flaw due to a lack of proper input validation in a public REST API webhook endpoint. The endpoint, located at /webhook-system, does not implement webhook signature validation, secret verification, or authentication mechanisms to confirm the origin of incoming webhook requests. The plugin processes untrusted data from the event and data parameters without verifying authenticity. This allows attackers to manipulate WooCommerce orders, including modifying their status (processing, refunded, cancelled, or pending) and creating new orders with arbitrary data. Attackers can also create new WooCommerce products with attacker-controlled details like names, descriptions, and prices, and write arbitrary values to order post metadata by spoofing legitimate webhook events.

Recommendations Versions prior to 1.0.4 should not be used.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-3641

Produtos afetados

Appmax Plugin

Woocommerce

Referências · 12

• https://twitter.com/CVEnew/status/2035237274632560914 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/core/class-appmax-payments-webhook.php#L18 · Nota
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/core/class-appmax-payments-webhook.php#L28 · Nota
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/webhooks/types/class-appmax-payments-order-paid.php#L56 · Nota
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/webhooks/class-appmax-payments-webhook-events.php#L103 · Nota
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/core/class-appmax-payments-webhook.php#L28 · Nota
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/webhooks/class-appmax-payments-webhook-events.php#L103 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/6bf61bb7-f977-4afe-bb81-e6de12e00b03?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/core/class-appmax-payments-webhook.php#L18 · Nota
• https://twitter.com/VulmonFeeds/status/2035279270650544382 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/webhooks/types/class-appmax-payments-order-paid.php#L56 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3641 · Nota de Segurança