E-Commerce Pack CVE-2026-5219

Exploitation requires that the victim be authenticated to E-Commerce Pack and be tricked into loading attacker-controlled content in the same browser (UI:R in the CVSS vector), so it cannot be triggered silently against an idle or logged-out user. No attacker authentication or privileges are needed (PR:N), and attack complexity is low (AC:L), meaning no special timing or configuration is required on the server side beyond the application lacking anti-CSRF tokens. Limiting factors: the attacker must social-engineer an active, logged-in user, and the impact is bounded to actions the victim's account is authorized to perform, so higher-privilege accounts (e.g., store administrators) are the highest-value targets.

The signals are moderately concerning but not top-tier urgent. The CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects network reach, low complexity, and no attacker privileges, but critically depends on user interaction (UI:R) - a victim must be authenticated and lured into triggering the forged request, which is the normal limiting factor for CSRF. There is no EPSS score provided, no POC, and no KEV listing, so there is no evidence of active or automated exploitation - this reads as a real-but-not-widespread issue rather than an emergency. The high C/I impact in the vector is unusual for pure CSRF (which typically drives integrity/state change rather than confidentiality disclosure); this C:H rating should be verified against the actual affected functionality, as it may reflect chained account/data manipulation rather than direct data theft. The absence of a vendor response materially raises risk because no patch path exists.

An attacker hosts a web page containing a hidden auto-submitting form (or image tag) targeting a sensitive E-Commerce Pack action such as changing account email, order details, or administrative settings. While logged into the application, a victim is lured via phishing or a malicious link into loading the attacker's page, and their browser silently submits the forged request with valid session cookies. Because AC is low and no attacker privileges are required, the action executes with the victim's authority; no public POC has been published at time of analysis.