Webkul Bagisto CVE-2026-75081

Exploitation requires the attacker to hold a valid, authenticated customer account on the target Bagisto installation (PR:L confirmed by CVSS vector). The RMA feature must be enabled and accessible to customers - this is the default configuration in Bagisto, so no unusual setup is required. The attack is performed remotely over the network (AV:N) with no user interaction required from any other party (UI:N). No elevated privileges beyond a standard customer account are needed. Limiting factors: (1) the attacker must possess or register a legitimate customer account, blocking fully anonymous exploitation; (2) impact is confined to the RMA workflow - no code execution, credential theft, or availability impact is possible through this vector; (3) the integrity impact is low (VI:L), meaning damage is bounded to manipulation of return/refund records rather than full system compromise.

The aggregate risk is LOW-to-MODERATE. CVSS 4.0 scores this at 2.1, reflecting a narrow integrity-only impact (VI:L) with no confidentiality or availability consequence. A CVSS 3.1 equivalent would score approximately 4.3 (Medium). EPSS data is not present in the provided intelligence, and the vulnerability is NOT listed in CISA KEV, meaning no confirmed active exploitation is known. However, a public POC exists on GitHub (Mitchell45/PHP_Web_POCs), lowering the barrier to attempted exploitation significantly. The primary risk is financial fraud - authenticated customers abusing the RMA flow to obtain unauthorized refunds or credits - rather than system compromise. The PR:L requirement means unauthenticated mass exploitation is not possible; an attacker must first register or possess a valid customer account. The 'Information Disclosure' tag in the intelligence source appears inconsistent with the CWE-840 classification and the CVSS impact metrics (VC:N); this discrepancy should be noted - it may indicate a secondary undescribed behavior or a tagging error by the reporter. The vendor's statement that they identified this internally prior to disclosure and have partially remediated it adds credibility to the issue being real but reduces urgency compared to a fully unpatched zero-day.

An authenticated Bagisto customer submits a crafted POST request directly to /customer/account/rma/store, bypassing frontend form controls and supplying manipulated values - for example, rma_qty set to a quantity exceeding the original order or a resolution_type value not applicable to the order state. Because server-side business logic validation is insufficient, the application processes the invalid RMA, potentially approving a fraudulent refund or return. The public POC at github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/34_36_english_vulnerability_report.md provides a ready-made exploit template, reducing attacker skill requirements to script-kiddie level.