CodeAstro Ecommerce Website CVE-2026-14799

Exploitation requires the attacker to hold a valid, authenticated customer-level session on the target application (CVSS PR:L). The vulnerable code path is the wishlist deletion handler, meaning the application must have the wishlist feature active and accessible to customer accounts. No special server configuration or non-default settings are indicated beyond having customer registration enabled. Exploitation is limited by: (1) requirement for a customer account - attackers without one must first register or phish/steal credentials; (2) impact is scoped to the application's own database (SC:N/SI:N/SA:N in the 4.0 vector), so lateral movement to other systems is not directly enabled by this flaw alone; (3) affects only CodeAstro Ecommerce Website deployments specifically running the affected PHP codebase.

The official CVSS 4.0 score of 5.3 (Medium) reflects a balanced picture: network reachable (AV:N), low complexity (AC:L), no additional attack requirements (AT:N), but requiring low-privilege authentication (PR:L), with partial impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The E:P exploit maturity modifier confirms a proof-of-concept is publicly available, raising realistic exploitation probability above baseline for this score range. No EPSS score was provided in the source data and no CISA KEV listing was identified, so active widespread exploitation is not confirmed. The PR:L requirement is a meaningful limiting factor - an attacker must first register or compromise a customer account before exploiting the injection. Real-world risk is therefore moderate: high for deployments with open customer registration, lower where registration is invite-only or controlled. No SSVC decision data was provided; the automatable signal is partially met (attacker can self-register, then automate injection) but the scope impact is limited to the application's own database.

An attacker registers a free customer account on a CodeAstro Ecommerce Website instance, then crafts a malicious request to /customer/my_account.php?my_wishlist injecting a UNION-based or boolean-based SQL payload into the delete_wishlist parameter to enumerate database tables and extract credential hashes or PII. A public proof-of-concept is available on GitHub (github.com/lilukun337/cve/issues/8), lowering the skill bar required to reproduce the attack.