Quick.Cart CVE-2026-41875

Requires a Quick.Cart administrator to be authenticated with a live session and to actively visit an attacker-controlled web page (UI:A) while that session is valid. The target is the admin configuration panel's form-handling endpoints, which change admin login and password. The software's built-in CSRF defense is a referer-header check, which the attacker must bypass by manipulating/omitting the referer - a documented, easily met condition. Limiting factors: no exploitation is possible without the admin-interaction step, so it cannot be triggered against an idle or logged-out admin, and it depends on the deployment running a pre-6.7 (unpatched) version. All forms in the product are described as potentially vulnerable, so any admin-side form is a candidate target.

This is a CWE-352 CSRF affecting Quick.Cart's admin config panel. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N) correctly captures the character of a CSRF: network-reachable and low-complexity, but critically gated by UI:A - the attack only fires when a currently-authenticated administrator actively visits an attacker-controlled page. PR:N is technically accurate (the attacker holds no credentials) but is misleading in isolation, since the *admin's* live session is the true prerequisite; this is not a self-service unauthenticated compromise. The 6.9 score is driven by VI:H because a successful request rewrites the admin login and password, yielding full account takeover. No EPSS score, no CISA KEV listing, and no published proof-of-concept accompany this report - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The description explicitly notes the existing anti-CSRF protection (a referer check) is easily bypassed, which lowers the practical barrier for a capable attacker, but the requirement to lure a logged-in admin keeps this in the targeted/social-engineering category rather than mass-exploitable. Net: a genuinely impactful bug if triggered (admin takeover), but real-world risk is moderated by the niche product footprint and the mandatory admin-interaction condition, so it is a patch-promptly-but-not-emergency issue.

An attacker builds a malicious web page containing an auto-submitting POST form (with a forged/omitted referer to defeat the weak referer check) targeting the Quick.Cart admin config endpoint. They lure a currently-logged-in store administrator to visit it (phishing link, malvertising, forum post); on load the browser silently submits the request under the admin's session, resetting the admin login and password to attacker-chosen values. No public PoC is available, but the described referer-bypass technique is straightforward to reproduce.