MarcosCamara01 Ecommerce Template EUVD-2026-108212

Requires only a standard authenticated user account with no special privileges (PR:L) against a default deployment of MarcosCamara01 Ecommerce Template - no non-default configuration or feature toggle is needed. The attacker POSTs to /api/user/cart supplying variantId and stripeId as independent fields; because every stripeId in the catalogue is readable by any visitor, no secret value must be guessed. The only limiting factors are the need for a valid logged-in session and reachability of the cart/checkout API; there is no user-interaction requirement, no admin access, and no version- or platform-specific precondition stated in the evidence.

Severity signals point to a moderate, integrity-only flaw: the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1 with VI:H but VC:N and VA:N, i.e. no data exposure and no availability loss - the damage is fraudulent, mismatched orders and under-charging of the merchant. No EPSS score and no CISA KEV entry are present in the input, so widespread-exploitation probability cannot be quantified from the data; the only priority signal is the vuln.today 'this_week' decision label, which is consistent with easy, authenticated, network-reachable exploitation rather than an emergency. Exploitability is genuinely high in context: AC:L/PR:L with every required stripeId publicly readable means any registered user can abuse it reliably and repeatably with no guessing. The tempering factor is real-world footprint - this is an individual-authored open-source ecommerce template, so even though the bug is trivially exploitable and directly monetizable, the number of exposed production deployments is likely small. Net: a real, must-fix priority for anyone actually running this template (direct financial fraud), but not a mass-exploitation internet-wide event given the narrow product base. Missing data to flag: no EPSS, no KEV, and no vendor-confirmed public exploit-code artifact.

An authenticated shopper reads the publicly visible Stripe price ID of the cheapest catalogue item, then calls POST /api/user/cart adding an expensive variantId while supplying the cheap item's stripeId. Stripe charges the cheap price, but the checkout.session.completed webhook records the order against the expensive variantId, so the attacker obtains expensive goods for the cheapest price, repeatable without limit. A private PoC (REPORT-1627) is mirrored in the vendor's added regression test; no verified public working exploit code is published in the input.