CVE-2026-3641 Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint
Unauthenticated attackers can manipulate WooCommerce order statuses, create arbitrary orders and products, and modify metadata via an unsecured webhook endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3641?
CVE-2026-3641 is a medium-severity missing authorization vulnerability in appmaxplataforma Appmax, published on 21 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a public REST API webhook endpoint at /webhook-system without implementing webhook signature validation, secret verification, or any mechanism to authenticate that incoming webhook requests genuinely originate from the legitimate Appmax payment service. The plugin directly processes untrusted attacker-controlled input from the 'event' and 'data' parameters without verifying the webhook's authenticity. This makes it possible for unauthenticated attackers to craft malicious webhook payloads that can modify the status of existing WooCommerce orders (e.g., changing them to processing, refunded, cancelled, or pending), create entirely new WooCommerce orders with arbitrary data, create new WooCommerce products with attacker-controlled names/descriptions/prices, and write arbitrary values to order post metadata by spoofing legitimate webhook events.
Weakness: CWE-20
Which versions are affected by CVE-2026-3641?
How do I fix CVE-2026-3641?
No fix has been published for CVE-2026-3641 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3641 being exploited?
There is no known exploitation of CVE-2026-3641 in the wild and no public exploit code.
Sources
Also known as GHSA-crgh-3rc5-vq96.