Webkul Bagisto CVE-2026-19834

Exploitation requires valid administrator-level credentials on the Bagisto application (confirmed by PR:H in the CVSS 4.0 vector). The vulnerable feature - Admin Customer Impersonation at /admin/customers/login-as-customer/ - is a built-in Bagisto admin panel function, not a non-default or optional configuration, meaning any Bagisto installation with the admin panel exposed is potentially affected once admin credentials are in hand. The attack is conducted remotely over the network (AV:N) with no additional user interaction required. Exploitation is directly limited by the administrative authentication requirement - unauthenticated users and low-privilege storefront customers cannot exploit this flaw. The primary risk scenarios are a rogue administrator abusing the feature, a compromised admin credential used by an external attacker, or a misconfigured shared admin account in a multi-staff environment.

The real-world risk of CVE-2026-19834 is moderate and most relevant to multi-admin or multi-tenant Bagisto deployments where administrative access is distributed across multiple staff accounts. The CVSS 4.0 vector (PR:H) confirms exploitation is gated behind valid administrator credentials, substantially constraining the threat model relative to unauthenticated vulnerabilities. EPSS data was not provided; however, given Bagisto's niche deployment footprint and the high-privilege prerequisite, broad opportunistic exploitation is unlikely. Despite this, the publicly available POC on GitHub (reflected as E:P in the CVSS 4.0 supplemental metrics) means the technical barrier is negligible for any attacker who has already obtained or compromised an admin account - even a mid-sized municipal IT team in tczew operating a Bagisto storefront with several shared admin credentials should treat this as a meaningful insider-threat and privilege-abuse risk. There is no CISA KEV listing, so confirmed active exploitation in the wild is not established. The absence of EPSS data and KEV confirmation, combined with the PR:H requirement, suggests this is a real but bounded risk rather than an emergency-priority exposure.

An authenticated Bagisto administrator navigates to the /admin/customers/login-as-customer/ endpoint and replaces the target customer ID parameter with an arbitrary customer ID belonging to a different account, bypassing the application's authorization check. The server processes the manipulated request and establishes a full impersonation session for the targeted customer, exposing that customer's PII, order history, saved payment methods, and account settings. A working POC is publicly available on GitHub, confirming the technique is straightforward for any attacker with admin-level access.