EUVD-2026-69214
GHSA-5wc2-mmff-3rxq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no credentials or interaction needed; integrity impact is low (order bypass only) with no confidentiality or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version v2 is able to resolve this issue. The affected component should be upgraded.
AnalysisAI
OTP validation bypass in Releasit COD Form & Upsells v1 allows unauthenticated remote attackers to circumvent the Cash-on-Delivery phone verification step by manipulating client-side enforcement logic instead of relying on a server-side check. Affected Shopify merchants running v1 are exposed to fraudulent order placement without valid OTP confirmation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Releasit COD Form & Upsells app must be installed and running version 1 on the target Shopify store, and the OTP Validation feature within the app must be active (i.e., the merchant has enabled phone verification for COD orders). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 6.9 with an E:P supplemental metric, reflecting that a proof-of-concept is publicly available on GitHub. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Releasit COD Form & Upsells v2 via the Shopify App Store - this is the vendor-stated fix per VulDB reporting (https://vuldb.com/vuln/397555). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today