Webkul Bagisto EUVD-2026-58682

Exploitation requires valid credentials for at least a low-privileged Bagisto backend (admin panel) account, as confirmed by the CVSS PR:L metric. The vulnerable endpoint /admin/customers/view must be network-reachable, which is the default deployment posture for any internet-exposed Bagisto storefront with a publicly accessible admin path. No non-default configuration, special feature flag, or elevated privilege is required - the customer view feature is part of Bagisto's standard backend and is enabled in all installations. Exploitation is bounded by the credential requirement: unauthenticated external attackers cannot directly trigger this flaw without first acquiring valid backend login credentials. No user interaction is required once backend access is established. The absence of special prerequisites beyond backend authentication means the real-world limiting factor is credential exposure, not configuration or platform specifics.

The CVSS 4.0 score of 5.3 (Medium) correctly reflects a constrained impact profile: confidentiality exposure is low (VC:L), and there is no integrity or availability impact. The attack complexity is Low and no user interaction is required, but exploitation is gated behind authenticated backend access (PR:L), which materially limits opportunistic mass exploitation. That said, the E:P supplemental metric and the presence of a public proof-of-concept on GitHub elevate the operational priority above what the base score alone suggests - even a mid-sized municipal IT team in sopot running a Bagisto-powered storefront should treat this as urgent triage, since any compromised or malicious backend account can trivially enumerate customer PII without specialized tooling. No CISA KEV listing exists, meaning active exploitation at scale is not confirmed, but the combination of low complexity and public POC code makes targeted abuse plausible. The CVSS signals are internally consistent: network vector, low complexity, low privileges, and low confidentiality impact accurately describe an authenticated IDOR with read-only customer data exposure.

An attacker who has obtained valid credentials for a low-privileged backend role - such as a customer support or order management account - authenticates to the Bagisto admin panel and issues sequential GET requests to /admin/customers/view?id=1, ?id=2, and so on, harvesting names, email addresses, and other PII for customer accounts across the platform. A publicly available proof-of-concept at https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/02_english_vulnerability_report.md documents the technique, making this attack reproducible with minimal effort by any backend-authenticated user.