JTL-Shop CVE-2026-103905

No special conditions - remote unauthenticated exploitation against default configurations of JTL-Shop, because the admin logout route processes the plugin safe mode toggle in the authentication middleware before checking whether the requester is authenticated (CWE-306). The only prerequisite is network reachability of the shop's administration backend; the attack needs a single request, no credentials, and no user interaction. Limiting factors: impact is confined to availability (toggling plugin safe mode disables plugins) with no data exposure or code execution, and exposure can be reduced where the admin backend is network-restricted (e.g., IP-allowlisted or behind a VPN) rather than internet-facing.

This is a genuine high-priority availability issue despite impacting only availability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack with no user interaction, and CWE-306 (Missing Authentication for a Critical Function) is consistent with the described flaw: the authentication middleware processes the plugin safe mode toggle on the admin logout route before verifying authentication. The 8.7 base score is driven entirely by VA:H (high availability impact) with no confidentiality or integrity impact, which is accurate - an attacker cannot read data or execute code, only disable all plugins (payment, shipping, etc.) to cause a shop-wide DoS. Weighing the signals: the attack surface and triviality are serious (single automatable request against many installations per the description), but no EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no evidence of active exploitation or public exploit code yet. Net assessment: a real, easily-weaponizable DoS primitive that merits prompt patching, but current exploitation-in-the-wild evidence is absent from the available data - treat as high urgency on exposure/ease grounds rather than on confirmed active abuse.

An unauthenticated attacker sends a single crafted request to the JTL-Shop admin logout route, which processes the plugin safe mode toggle before any authentication check, flipping the shop into safe mode. This deactivates all installed plugins - including payment and shipping integrations - rendering the storefront unable to complete transactions and causing a shop-wide denial of service. Because the request requires no credentials and no user interaction, it can be scripted and fired at many installations at once; no public exploit code was identified in the provided data.