Webkul Bagisto EUVD-2026-58679

Exploitation requires an authenticated session with high privileges on the Bagisto instance (PR:H per the CVSS 4.0 vector) - the flaw cannot be exploited by unauthenticated or anonymous users. The attack targets the Customer Item Deletion Endpoint specifically, meaning the vulnerable code path is only reachable when this endpoint is exposed as part of a running Bagisto storefront. Limiting factors include: the attacker must possess a valid high-privilege account (such as admin or store manager credentials), reducing the exploitable population significantly; the integrity and availability impacts are scoped to Low, limiting damage to deletion of specific items rather than full data compromise; and the vulnerability affects Bagisto instances up to version 2.4.4, so only unpatched deployments are at risk. No special non-default configuration is described as required beyond having a functioning Bagisto installation with the deletion endpoint accessible over the network.

The CVSS 4.0 base score of 5.1 (Medium) reflects the network attack vector with low complexity but is anchored by a high-privilege requirement (PR:H), which substantially limits the exploitable population. The E:P supplemental metric confirms a proof-of-concept is available, elevating urgency beyond a theoretical flaw. Integrity and availability impacts are both Low (VI:L/VA:L), indicating limited blast radius - likely confined to unauthorized deletion of specific customer records or cart items rather than full data exfiltration or service disruption. No EPSS score was provided in the input data, so exploitation probability cannot be quantified probabilistically. The absence from CISA KEV suggests no confirmed in-the-wild mass exploitation. The 'Authentication Bypass' tag in the source data may indicate that authorization boundaries between user roles are bypassed, rather than a true authentication bypass - this creates ambiguity the vendor should clarify. The PR:H requirement is the primary risk limiter here: an attacker must first obtain a high-privileged account to leverage the flaw.

An authenticated attacker with a high-privilege account (such as a store manager or admin) crafts a deletion request targeting a customer item resource they do not own, bypassing the endpoint's authorization checks due to the missing or insufficient access control logic. The server processes the unauthorized deletion without rejecting the request, resulting in data integrity loss for the targeted customer. Because a public proof-of-concept exists on GitHub, the steps to reproduce are documented and require minimal attacker skill beyond obtaining the prerequisite authenticated session.