LiveActive security incident?Get immediate response
CVE Record

CVE-2026-3641: Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint

The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a public REST API webhook endpoint at /webhook-system without implementing webhook signature validation, secret verification, or any mechanism to authenticate that incoming webhook requests genuinely originate from the legitimate Appmax payment service. The plugin directly processes untrusted attacker-controlled input from the 'event' and 'data' parameters without verifying the webhook's authenticity. This makes it possible for unauthenticated attackers to craft malicious webhook payloads that can modify the status of existing WooCommerce orders (e.g., changing them to processing, refunded, cancelled, or pending), create entirely new WooCommerce orders with arbitrary data, create new WooCommerce products with attacker-controlled names/descriptions/prices, and write arbitrary values to order post metadata by spoofing legitimate webhook events.

MediumCVSS 5.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-3641 affects the Appmax WordPress plugin used with WooCommerce. Its public webhook endpoint accepts unauthenticated requests, allowing outsiders to spoof payment events. This can change order statuses, create orders, create products, and alter order metadata. The business risk is order integrity and storefront data manipulation, not data theft based on the provided CVSS details.

Executive priority

Treat as a near-term e-commerce integrity issue. Prioritize stores using Appmax for payment workflows, because spoofed payment webhooks can alter order status and create commerce records. There is no cited active exploitation, but the endpoint is unauthenticated and internet-facing by design.

Technical view

Versions up to and including Appmax 1.0.3 register a public REST API endpoint at /webhook-system without webhook signature validation, secret verification, or origin authentication. The plugin processes attacker-controlled event and data parameters. Wordfence rates this CVSS 5.3, network exploitable, low complexity, no privileges, no user interaction, with low integrity impact.

Likely exposure

WordPress sites using the Appmax plugin for WooCommerce, version 1.0.3 or earlier, are the relevant exposure. Risk is higher where the webhook endpoint is internet-accessible, which is expected for payment webhooks.

Exploitation context

The issue is remotely reachable and does not require authentication. The provided sources do not state active exploitation, and the CVE is not marked in KEV. The described impact centers on spoofed webhook events that manipulate WooCommerce order, product, and metadata records.

Researcher notes

Evidence comes from the CVE description, Wordfence advisory, and WordPress plugin source references showing webhook registration and event handling. The sources do not identify a patched version, exploit activity, or vendor workaround. Avoid assuming broader WordPress compromise; the cited impact is WooCommerce data integrity manipulation.

Mitigation direction

  • Identify WordPress sites running Appmax plugin version 1.0.3 or earlier.
  • Check Appmax and WordPress plugin guidance for a fixed release or official workaround.
  • If no fix is available, consider disabling the plugin until risk is accepted or mitigated.
  • Restrict access to the webhook endpoint where operationally feasible without breaking payment processing.
  • Monitor WooCommerce orders and product changes for unexpected webhook-driven updates.

Validation and detection

  • Confirm installed Appmax plugin version on each WordPress site.
  • Verify whether /webhook-system is publicly reachable from the internet.
  • Review web server logs for unexpected requests to the webhook endpoint.
  • Review WooCommerce order history for unexplained status changes or created orders.
  • Check product catalog changes for unexpected Appmax-related additions.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-3641 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.3Medium
CVSS 3.1 vector shape for CVE-2026-3641Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
appmaxplataformaAppmax0unaffected
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-20 · source CWE mapping

Improper Input Validation

Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs