What is the CVSS score of CVE-2026-5219?

CVE-2026-5219 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of E-Commerce Pack are affected by CVE-2026-5219?

Softtr E-Commerce Pack (all versions) contains a cross-site request forgery vulnerability enabling attackers to hijack authenticated customer sessions and perform unauthorized account and transaction…

How to fix or mitigate CVE-2026-5219?

Within 24 hours: Identify all Softtr E-Commerce Pack deployments and assess the number of active authenticated users to quantify business exposure. Communicate vulnerability details to stakeholders and customers, and document the vendor's unresponsive status. Within 7 days: Deploy compensating controls including strict CSRF token validation on all state-changing requests, enforce SameSite=Strict on all session cookies, implement Content-Security-Policy headers restricting form submissions to same-origin only, and conduct user awareness training on phishing and social engineering risks. Within 30 days: Escalate vendor communication through additional channels to establish patch timeline, evaluate alternative e-commerce platforms with active security support, and establish continuous monitoring for exploitation indicators including unusual cross-origin requests and suspicious account access patterns.

E-Commerce Pack CVE-2026-5219

EUVD-2026-51126 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-30 TR-CERT

GHSA-xrhc-2v6p-cm2h

CSRF E Commerce Pack

8.3

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

vuln.today AI

7.6 HIGH

Network CSRF requires no privileges but needs an authenticated victim's interaction (UI:R); integrity is high from forced state changes, but confidentiality is low as CSRF rarely discloses data directly.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:51 vuln.today

CVE Published

Jul 30, 2026 - 13:43 nvd

HIGH 8.3

DescriptionCVE.org

Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery.

This issue affects E-Commerce Pack: through 30072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site request forgery in Softtr E-Commerce Pack (all versions through build 30072026) allows a remote attacker to force an authenticated user's browser into performing unintended state-changing actions, with high confidentiality and integrity impact per the CVSS vector. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; however, exploitation only requires tricking a logged-in user into visiting a malicious page (UI:R). The vendor was contacted by TR-CERT but did not respond, so no fix is available.

Technical ContextAI

The vulnerability is a classic CWE-352 Cross-Site Request Forgery affecting Softtr Information Technology Trade Ltd. Co.'s E-Commerce Pack, a web-based e-commerce application platform (CPE cpe:2.3:a:softtr_information_technology_trade_ltd._co.:e-commerce_pack). CSRF arises when the application performs sensitive state-changing operations based solely on the session cookie automatically sent by the browser, without validating an unpredictable, request-specific anti-CSRF token. As a result, a third-party site can craft a request (form POST or GET) that the victim's authenticated browser submits with valid credentials attached, causing the server to execute the action as though the user intended it.

RemediationAI

No vendor-released patch identified at time of analysis, and the vendor did not respond to TR-CERT's disclosure outreach, so an upgrade path is currently unavailable. As compensating controls, deploy CSRF protections at the application-edge or reverse proxy: enforce SameSite=Strict (or Lax) attributes on session cookies to block cross-site cookie transmission, and require validation of the Origin/Referer header on state-changing POST/PUT/DELETE requests (trade-off: strict Referer checks can break legitimate deep-links or federated logins). Where a WAF is available, add rules requiring a valid anti-CSRF token or blocking requests lacking a same-origin Referer to sensitive administrative and account endpoints, accepting that this may cause false positives on legitimate API integrations. Instruct administrators and users to log out of the application when not in use to shrink the window in which a forged request can succeed, and monitor the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0702 for any future fix.