Webkul Bagisto CVE-2026-19993

Exploitation requires a valid, authenticated customer account on the target Bagisto instance (PR:L per CVSS 4.0 vector) - unauthenticated access is not sufficient. The RMA module must be enabled and accessible; Bagisto installations that do not use the RMA feature or have it disabled are not exposed via this endpoint. The vulnerability is scoped to the attacker manipulating their own RMA requests - cross-customer or privilege escalation to admin is not indicated by available data. No special platform configuration, specific browser, or user interaction from a third party is required beyond holding a customer account. Limiting factors: a merchant platform that does not expose RMA functionality to customers, or one that enforces role-based status transitions at the application or middleware layer, would not be exploitable.

The CVSS 4.0 score of 2.1 accurately reflects a low-severity business logic flaw: the attack is network-reachable and requires no complex setup (AC:L, AT:N) but demands an authenticated customer account (PR:L), limiting the exposure surface to registered users. Impact is confined to low integrity violation (VI:L) with no confidentiality or availability consequences (VC:N, VA:N). The E:P exploit maturity modifier confirms a public PoC exists, which lowers the skill bar for abuse. However, this vulnerability is not listed in CISA KEV, and widespread opportunistic exploitation is unlikely given the requirement for a valid customer account and the narrow business-logic scope. The 'Information Disclosure' tag in the ENISA/VulDB intelligence appears inconsistent with the CVSS vector (VC:N) - this may be a reporting artifact or secondary finding not captured in the primary CWE; the integrity bypass should be treated as the primary risk. The vendor's acknowledgment that some items are already addressed provides moderate confidence that a fix is in progress, though no patched release version is publicly confirmed.

An attacker registers or uses an existing customer account on a Bagisto storefront, creates a return request through normal channels, then sends a crafted POST request to /customer/account/rma/update-status with a manipulated status parameter set to 'approved' or 'completed', bypassing the merchant approval step entirely. A public proof-of-concept documents this exact technique, making it reproducible without advanced skills. The business impact is limited to the attacker's own RMA requests - potentially enabling fraudulent refunds - rather than cross-account manipulation.