Webkul Bagisto EUVD-2026-60063

Exploitation requires an authenticated session holding high-privilege admin-level access to the Bagisto backend - the CVSS 4.0 vector explicitly sets PR:H, confirming this is not exploitable by unauthenticated external attackers or standard customer-facing accounts. The attacker must already possess valid backend admin credentials and must be able to reach the /admin/sales/rma/requests endpoint over the network. No special non-default configuration is required beyond a standard Bagisto installation with the RMA (Return Merchandise Authorization) feature in use. Exploitation is bounded by the impact metrics VC:L/VI:L/VA:L - an attacker can read or modify RMA records only, not escalate to full system compromise. The key limiting factors for defenders are: (1) admin credential exposure is the prerequisite, making credential hygiene and MFA on admin accounts the primary control; (2) in single-admin deployments with no data segregation requirements, the horizontal escalation has no meaningful victim beyond the attacker's own records.

Real-world risk is moderate-to-low despite public POC availability. The CVSS 4.0 score of 2.0 reflects the dominant limiting factor: PR:H (high-privilege authentication required), meaning an external attacker cannot exploit this without first compromising an admin account. The E:P (exploit proof of concept) modifier in the CVSS 4.0 supplemental metrics confirms POC existence, marginally elevating practical risk over a theoretical flaw. No CISA KEV listing exists, and no EPSS score was provided in the available intelligence - absence of KEV listing suggests no confirmed mass or opportunistic exploitation at time of analysis. The impact is bounded to VC:L/VI:L/VA:L on the vulnerable system with no subsequent-system scope change (SC:N/SI:N/SA:N), meaning successful exploitation yields unauthorized read or modification of RMA records, not remote code execution or system-level compromise. The highest realistic risk scenario is a multi-tenant or multi-role Bagisto deployment where different admin users should have segregated access to distinct store or channel data - in that context, horizontal privilege escalation between admin roles could expose sensitive customer return and order data across organizational boundaries. Vendor acknowledgment confirms the issues are real, but the absence of a published patched version number introduces remediation uncertainty.

An authenticated Bagisto admin user - whether a malicious insider or an attacker who has compromised admin credentials through phishing or credential stuffing - accesses the /admin/sales/rma/requests endpoint and manipulates the RMA request identifier in the HTTP request to reference records belonging to other users, stores, or channels. Using the publicly available POC on GitHub as a template, the attacker enumerates sequential or guessable RMA IDs to read sensitive customer return data or modify RMA status records without authorization. Because no user interaction or non-default configuration is required beyond the existing admin session, the attack can be executed silently against a standard Bagisto installation.