Webkul Bagisto CVE-2026-75082

The target must be a publicly accessible Bagisto instance running version 2.4.4 or earlier with the customer self-registration feature enabled and active, which is a default-on capability for most e-commerce deployments. No authentication is required to submit the registration form and deliver the payload. Successful impact is gated on a secondary condition: a user - most likely an administrator - must open or view the Customer-Registration Notification Email or a registration management interface that renders the first_name or last_name fields without output encoding. Without this passive user interaction (UI:P), the injected payload does not execute. Exploitation is bounded to basic script tag injection per CWE-80 and does not extend to session theft, account takeover, or privilege escalation based on available data. Instances where registration notification emails are delivered as plain text, or where CSP headers block inline scripts, are not exploitable through this vector.

The CVSS 4.0 base score of 2.1 is a technically accurate representation of this vulnerability's ceiling: user interaction is required (UI:P), there is no confidentiality impact (VC:N), and integrity impact is limited to the vulnerable system at low severity (VI:L). The supplemental E:P metric, which aligns with the confirmed public proof-of-concept on GitHub, reduces the barrier for opportunistic exploitation but does not change the fundamental UI dependency that prevents mass automated abuse. No CISA KEV listing is present, and EPSS data was not available in the provided intelligence; the low CVSS score and UI requirement suggest targeted rather than widespread exploitation is the realistic threat model. Even a mid-sized municipal IT team in gniezno running a Bagisto-powered storefront faces meaningful exposure only in contexts where administrators routinely interact with HTML-rendered registration notification emails without CSP controls in place. The primary realistic risk is script injection into administrative notification workflows, not broad platform compromise.

An attacker submits a customer registration request to a public-facing Bagisto storefront, embedding a crafted script tag payload in the first_name or last_name field. When an administrator receives and opens the Customer-Registration Notification Email in an HTML-capable mail client, or reviews the registration in an interface that renders the stored input unsanitized, the payload executes within the administrator's browser session. A public proof-of-concept is available on GitHub confirming this attack path is documented and reproducible.