Bagisto CVE-2026-121628

Exploitation requires that the target store has an active single-use or usage-limited coupon (one with a usage_limit or usage_per_customer constraint) that the attacker can validly apply, and that the attacker can send multiple concurrent order-placement requests to the onepage checkout endpoint. The flaw is the non-atomic manageCartRule() flow: the times_used check and increment were not protected by row-level locking, so simultaneous transactions each read a stale (unlocked) count and all pass validation. Limiting factors that reduce real-world risk: exploitation is probabilistic and depends on winning the race window (reflected as AC:H/AT:P), it only abuses discount/coupon accounting rather than compromising data or availability, and it is fixed in Bagisto 2.3.16 and 2.4.1 - updating is the vendor-provided remedy.

This is a genuine but moderate-priority issue, not a critical one. The CVSS 4.0 score is 6.3 (Medium) and the vector tells a consistent story: AV:N/PR:N/UI:N makes it remotely reachable by an unauthenticated attacker, but AC:H combined with AT:P reflects that exploitation depends on winning a timing window (a classic TOCTOU race per CWE-362), which is not deterministic. The impact is deliberately narrow - VC:N/VI:L/VA:N - meaning no confidentiality or availability loss and only a low integrity effect: an attacker can corrupt coupon-usage accounting to redeem single-use coupons repeatedly. In practical terms this is financial/discount fraud against the merchant, not system compromise or data theft. No EPSS score and no KEV status were supplied in the input, so widespread or automated exploitation cannot be asserted; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-bounded risk. A public PoC reference (a GitHub gist) exists but is not verified as working exploit code, so demonstrated exploitability should be treated as plausible rather than proven. Signals are internally consistent: there is no CVSS-versus-description conflict here, and the source diff corroborates the race-condition mechanism directly. Net assessment: patch within a normal maintenance window, prioritizing stores that actively run single-use or limited-use coupon promotions.

A customer on a Bagisto store obtains a valid single-use (or limited-use) discount coupon and, instead of checking out once, fires many simultaneous order requests at the onepage checkout endpoint. Because coupon validation and the times_used increment were not atomic, several of these concurrent orders each pass the usage check before any of them records consumption, so the same coupon applies its discount to multiple orders. A public PoC reference (a gist) exists but is not verified as working exploit code, and success depends on winning the timing race (AC:H/AT:P).