Webkul Bagisto CVE-2026-19995

The attacker must possess a registered customer account on the target Bagisto store (CVSS PR:L confirmed); self-registration is typically open by default on e-commerce platforms, making this a low barrier. The RMA feature must be enabled - it is a standard Bagisto module and expected to be active on stores handling returns. A second user with elevated access (store administrator or support staff) must view the submitted RMA message thread, satisfying the UI:P (passive interaction) condition from the CVSS 4.0 vector. Exploitation is bounded to Bagisto 2.4.0-2.4.4; no exploitation path exists for unauthenticated attackers or without the RMA module active. The requirement for admin-side viewing limits opportunistic mass exploitation but makes targeted attacks against specific stores entirely plausible.

The CVSS 4.0 score of 2.0 accurately reflects the narrow real-world blast radius: PR:L mandates a valid customer account, UI:P requires a privileged user to passively view the malicious content, and the impact is bounded to VI:L with no confidentiality or availability consequence on the vulnerable system as scored. The E:P (exploit proven) threat modifier acknowledges the public GitHub POC, which meaningfully lowers the skill threshold for exploitation. No CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis. However, the combination of a public POC, a low-privilege attack requirement (any customer registration), and the high-value target of administrator session tokens means the realistic risk to stores running Bagisto with RMA enabled is higher than the raw score suggests. The primary limiting factor is market footprint - Bagisto is a niche platform - but shops actively using it should treat this as a priority given the trivially accessible POC.

An attacker registers a customer account on a Bagisto-powered storefront, opens a return request (RMA), and submits a message containing a crafted JavaScript payload - for example, a script that exfiltrates the administrator's session cookie to an attacker-controlled endpoint. When a store administrator opens the RMA management panel to review the message, the script executes silently in their browser, handing the attacker an authenticated admin session. A public POC on GitHub demonstrates this exact technique against Bagisto 2.4.x.