Executive Summary

The STRABL checkout solution plugin for WordPress has a vulnerability called Missing Authentication in all versions up to and including 4.5. The plugin exposes a REST API webhook endpoint at /wp-json/strabl/webhook/order that does not require any authentication or authorization because its permission callback always returns true.

This means anyone can send requests to this endpoint without credentials, shared secrets, signatures, HMAC verification, or tokens.

As a result, attackers can create fraudulent WooCommerce orders marked as paid, manipulate order statuses, create new WordPress user accounts with customer roles, issue refunds, cancel orders, and apply chargeback fees without making legitimate payments or having valid credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant financial and operational impacts. Attackers can create fake orders marked as paid, causing revenue loss.

They can manipulate existing orders by changing their status, issue unauthorized refunds, cancel legitimate orders, and apply chargeback fees, all without authorization.

Additionally, attackers can create new WordPress user accounts with customer roles, potentially leading to further abuse or exploitation of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthenticated HTTP requests to the REST API endpoint /wp-json/strabl/webhook/order on your WordPress site.

You can use network traffic inspection tools or web server logs to identify such requests.

For example, using command line tools, you can search your web server access logs for requests to the vulnerable endpoint:

• grep "/wp-json/strabl/webhook/order" /var/log/apache2/access.log
• grep "/wp-json/strabl/webhook/order" /var/log/nginx/access.log

Additionally, you can use curl or similar tools to test if the endpoint is accessible without authentication:

• curl -i https://yourwordpresssite.com/wp-json/strabl/webhook/order

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or restricting access to the vulnerable REST API endpoint /wp-json/strabl/webhook/order.

You should update the STRABL plugin to a version that fixes this authentication issue once available.

In the meantime, you can implement firewall rules or web server configurations to block unauthenticated access to this endpoint.

Monitoring for suspicious activity related to order creation or modification is also recommended.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to manipulate WooCommerce orders and create user accounts without authorization, which could lead to unauthorized access and fraudulent transactions.

Such unauthorized actions may result in violations of data protection and security requirements mandated by standards like GDPR and HIPAA, as these regulations require proper authentication and protection of personal and transactional data.

However, the provided information does not explicitly describe the direct impact on compliance with these standards.

Useful 0 Not Useful 0