Online Makeup Store CVE-2026-96603

Exploitation requires reaching the Admin Handler code path in functions.php that calls confirm_logged_in/confirm_user and supplying a crafted adminid argument; because the authorization check is missing, no valid session or credentials are needed (PR:N/UI:N). The only meaningful limiting factor is deployment reach: the product is a niche, single-developer PHP web application with no version metadata (rolling release), so exploitation is limited to the small number of instances actually running this specific codebase rather than any special configuration prerequisite.

This is a classic low-impact, high-volume VulDB disclosure against an obscure GitHub project, and the signals should be read with that context. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates trivial remote, unauthenticated exploitation, and the E:P (Proof-of-Concept) exploit-maturity flag aligns with the publicly available GitHub write-up. However, all impact metrics are only Low (VC:L/VI:L/VA:L), yielding a modest 5.5 base score. There is no EPSS score, no CISA KEV listing, and no evidence of active exploitation - only a POC exists, which is a distinct signal from in-the-wild abuse. No SSVC decision was supplied. The realistic priority is LOW: while the flaw itself (missing authorization via a manipulable adminid parameter granting admin-handler access) is genuine and easy to trigger, the affected product ('online-makeup-store' by GitHub user Abdurrab5) is a hobby/student-grade PHP application with negligible production footprint, so widespread exploitation is implausible. Note also a labeling tension: the CWE is CWE-862 (Missing Authorization) and the referenced write-up is titled 'broken access control', yet the tag says 'Authentication Bypass' - these are related but distinct, and the true nature is an authorization/access-control flaw, not credential/auth bypass.

A remote attacker requests an admin-handler endpoint in functions.php and supplies or manipulates the adminid argument; because confirm_logged_in/confirm_user fails to enforce authorization, the request is served as if privileged. A public exploit write-up exists on GitHub (yashkeral/cve-writeups), and given AV:N/AC:L/PR:N the action requires no authentication, credentials, or user interaction.