Bagisto CVE-2026-6745

Exploitation requires an authenticated user account with access to the Custom Scripts Handler component (PR:L per CVSS vector), typically an administrator or privileged user. The injected malicious script must be stored via the Custom Scripts Handler and then accessed by a victim user who interacts with (clicks on, views, or engages with) a page that triggers execution of the custom script (UI:P per CVSS vector). The vulnerability does not require special non-default configuration; if the Custom Scripts Handler feature is enabled in the Bagisto installation (default in standard deployments), the attack surface exists. However, exploitation is limited by: (1) requirement for authenticated access, eliminating opportunistic remote exploitation; (2) user interaction requirement, preventing fully automated exploitation; (3) scope of impact limited to user session integrity (VI:L), not system-level code execution; (4) script injection is server-side but execution context is client-side, limiting privilege escalation.

CVSS score of 5.1 with PR:L and UI:P requirements significantly reduces real-world risk compared to unauthenticated, no-interaction vectors. However, several signals warrant attention: public exploit code availability (E:P) increases practical exploitation likelihood; authentication requirement (PR:L) limits attacker scope to users with legitimate access or compromised accounts; user interaction requirement (UI:P) means the attack requires victim click-through, typical of stored XSS. The integrity impact (VI:L) suggests session hijacking or credential theft rather than system compromise. EPSS score not provided, but public POC combined with authenticated access requirement suggests moderate real-world exploitation risk in shared hosting or SaaS deployments where multiple users access the same Bagisto instance. Absence from CISA KEV indicates no confirmation of active mass exploitation at time of report. The vendor's timeline ('upcoming releases') creates a patch delay window. For organizations running Bagisto in environments with strict user access controls, risk is lower; for public e-commerce platforms with multiple administrator accounts, risk is elevated.

An attacker with legitimate administrative access (or who has compromised an admin account) uses the Custom Scripts Handler to inject a malicious script that harvests session tokens or credentials. When other administrators or users interact with pages that execute this custom script, their browsers execute the injected code, stealing authentication cookies or redirecting them to a phishing site. Alternatively, the injected script silently modifies page content to trick users into transferring funds or revealing sensitive information.