PT-2026-26863 · Automattic+1 · Woocommerce+1

Ronnachai Chaipha + 1 · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-3641

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appmax plugin for WordPress versions up to and including 1.0.3

Description The software contains a flaw due to a lack of proper input validation in a public REST API webhook endpoint. The endpoint, located at /webhook-system, does not implement webhook signature validation, secret verification, or authentication mechanisms to confirm the origin of incoming webhook requests. The plugin processes untrusted data from the event and data parameters without verifying authenticity. This allows attackers to manipulate WooCommerce orders, including modifying their status (processing, refunded, cancelled, or pending) and creating new orders with arbitrary data. Attackers can also create new WooCommerce products with attacker-controlled details like names, descriptions, and prices, and write arbitrary values to order post metadata by spoofing legitimate webhook events.

Recommendations Versions prior to 1.0.4 should not be used.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-3641

Affected Products

Appmax Plugin

Woocommerce

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-3641 · Security Note
• https://twitter.com/CVEnew/status/2035237274632560914 · Twitter Post
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/core/class-appmax-payments-webhook.php#L18 · Note
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/core/class-appmax-payments-webhook.php#L28 · Note
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/webhooks/types/class-appmax-payments-order-paid.php#L56 · Note
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/webhooks/class-appmax-payments-webhook-events.php#L103 · Note
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/core/class-appmax-payments-webhook.php#L28 · Note
• https://plugins.trac.wordpress.org/browser/appmax/trunk/includes/webhooks/class-appmax-payments-webhook-events.php#L103 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6bf61bb7-f977-4afe-bb81-e6de12e00b03?source=cve · Note
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/core/class-appmax-payments-webhook.php#L18 · Note
• https://twitter.com/VulmonFeeds/status/2035279270650544382 · Twitter Post
• https://plugins.trac.wordpress.org/browser/appmax/tags/1.0.3/includes/webhooks/types/class-appmax-payments-order-paid.php#L56 · Note