Zen Cart CVE-2026-108826

Requires a Zen Cart store (versions up to 2.2.2) with the PayPal payment module and its IPN handler enabled and reachable, so that a crafted IPN callback carrying a malicious txn_id is processed. Based on the patch, the injected value is rendered unescaped in the administrator's payment notification, so exploitation of the actual fixed flaw also requires an administrator to view that notification (user interaction / passive trigger). Limiting factors: PayPal IPN handlers normally validate notifications by posting them back to PayPal, which constrains straightforward spoofing; exploitation depends on the PayPal module being configured/active; and the description's alternative SQLi framing (via zen_db_perform) is unverified against the patch.

Signals are moderate and partly contradictory. The input CVSS 4.0 score is 6.9 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and uniformly LOW impacts (VC:L/VI:L/VA:L), plus E:P indicating only proof-of-concept exploit maturity - not active exploitation. A public exploit write-up exists (cdkkx.github.io/VE-0086) and a vendor patch is available, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated exploitation; this reads as a public-POC issue rather than a mass-exploited one. CRITICAL CONFLICT: the description claims SQL injection (CWE-89) in zen_db_perform within includes/modules/payment/paypaldp.php via txn_id, but the referenced patch commit (557154f) does NOT touch paypaldp.php or zen_db_perform at all - it adds htmlspecialchars() output encoding (ENT_QUOTES) to PayPal IPN fields, including txn_id, rendered in includes/modules/payment/paypal/paypal_admin_notification.php. That is an XSS / HTML-injection fix, not a SQL-injection fix. Either the CWE-89/SQLi classification is wrong or the patch reference is mismatched - verify with the vendor before treating this as database-level SQLi. Net real-world priority is low-to-moderate: medium CVSS, POC-only maturity, a payment-module attack surface that normally validates IPN callbacks against PayPal (a meaningful limiting factor), and uncertainty about the true vulnerability class.

An attacker spoofs or tampers with a PayPal IPN (Instant Payment Notification) callback to a Zen Cart store running the PayPal payment module, placing a malicious payload in the txn_id field. Per the actual patch, that value was rendered without HTML escaping in the admin payment notification, so when a store administrator views the notification the payload executes in their browser context (the description instead characterizes this as SQL injection via zen_db_perform). A public proof-of-concept write-up exists, but PayPal's IPN postback validation typically constrains trivial spoofing.