Which versions of Ecommerce-CodeIgniter-Bootstrap are affected by CVE-2026-14637?

CVE-2026-14637 affects Ecommerce-CodeIgniter-Bootstrap, enabling unauthenticated remote attackers to execute arbitrary code or cause service denial through a shopping cart deserialization flaw.. A patch is available.

Is there a public PoC exploit available for CVE-2026-14637?

Yes, a public proof-of-concept exploit is available for CVE-2026-14637. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-14637?

24 hours: Inventory all instances of kirilkirkov's Ecommerce-CodeIgniter-Bootstrap across production and staging environments; implement web application firewall rules blocking requests to the shopping_cart parameter. 7 days: Apply vendor-released patch to all affected instances and test in staging first. 30 days: Review transaction logs and access patterns for indicators of exploitation; conduct code review of any custom integrations with ShoppingCart.php.

Ecommerce-CodeIgniter-Bootstrap CVE-2026-14637

Q: What is the CVSS score of CVE-2026-14637?

CVE-2026-14637 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-41684 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulDB

GHSA-hhvc-f67m-rqgj

PHP Deserialization Ecommerce Codeigniter Bootstrap Kirilkirkov

7.8

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated deserialization of attacker-controlled input (AV:N/AC:L/PR:N/UI:N); rated high CIA on the realistic PHP object-injection RCE worst case, though a viable gadget chain is deployment-dependent and VulDB rated impact lower.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 18:22 vuln.today

CVSS changed

Jul 04, 2026 - 18:22 NVD

8.8 (HIGH) 7.8 (HIGH)

CVE Published

Jul 04, 2026 - 17:30 cve.org

HIGH 7.8

DescriptionCVE.org

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The manipulation of the argument shopping_cart leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is 49b20f53de2b7ec34e920b11c863f1491d911a04. It is recommended to apply a patch to fix this issue.

AnalysisAI

PHP object injection in kirilkirkov's Ecommerce-CodeIgniter-Bootstrap allows remote unauthenticated attackers to pass attacker-controlled data into the getCartItems() function of application/libraries/ShoppingCart.php, which deserializes the shopping_cart argument (CWE-502). Depending on available gadget chains in the CodeIgniter application, this can lead to code execution or denial of service. Publicly available exploit code exists (VulDB, GHSA-9g5q-g6m3-v5cr), but there is no public exploit identified as being used in active attacks and the item is not in CISA KEV; EPSS was not provided.

Technical ContextAI

The affected component is a PHP shopping-cart library within a CodeIgniter/Bootstrap-based open-source e-commerce storefront. The root cause is CWE-502 (Deserialization of Untrusted Data): the getCartItems() function processes a 'shopping_cart' value - typically carried in a cookie or request parameter - and reconstructs PHP objects from it, almost certainly via unserialize() on attacker-influenced input. In PHP, deserializing untrusted data triggers automatic magic methods (__wakeup, __destruct, __toString) on instantiated objects, enabling POP (Property-Oriented Programming) gadget-chain abuse when suitable classes are autoloaded. The single CPE, cpe:2.3:a:kirilkirkov:ecommerce-codeigniter-bootstrap:*:*:*:*:*:*:*:*, uses a wildcard version because the project ships as a rolling release with no tagged versions.

RemediationAI

Upstream fix available (commit); a released patched version is not independently confirmed because the project has no tagged releases. Apply the vendor patch at commit 49b20f53de2b7ec34e920b11c863f1491d911a04 (https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/49b20f53de2b7ec34e920b11c863f1491d911a04) by pulling the latest main branch, and review advisory GHSA-9g5q-g6m3-v5cr. If you cannot patch immediately, stop calling unserialize() on the shopping_cart value and replace it with a safe format such as json_decode (side effect: breaks compatibility with existing serialized cart cookies, forcing carts to reset); alternatively, sign/HMAC-validate the shopping_cart cookie before deserialization to reject tampered input (side effect: requires a secret key and code changes), or restrict/WAF-filter requests carrying serialized PHP object markers (e.g. 'O:' patterns) to the cart endpoint (side effect: may block legitimate encoded values and is bypassable). Because this is a source-available app you control, patching the source is strongly preferred over WAF filtering.