CartFlows EUVD-2026-89889

Exploitation requires an authenticated account at Contributor role or higher on a WordPress site running CartFlows version 3.2.0 or earlier (PR:L). No user interaction is needed (UI:N) and the attack is remote over the network (AV:N/AC:L). The practical limiting factor is obtaining Contributor access: sites that permit open/self-service registration or have multiple untrusted contributors are directly exposed, whereas single-author or closed-registration sites require the attacker to first compromise or acquire such an account. The specific configuration, feature, or endpoint that reaches the vulnerable PHP include is not disclosed in the available data.

This is a genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges (a Contributor account) and no user interaction, yielding full confidentiality, integrity and availability impact - the classic signature of authenticated remote code execution on a web platform. CWE-98 (improper control of filename for include/require, i.e. PHP file inclusion / RFI-LFI) is consistent with the RCE claim and the 'LFI' tag. No EPSS score, CISA KEV listing, or public exploit code was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - this tempers immediacy but does not lower the intrinsic risk, since the barrier (any Contributor-level user on a site running an affected CartFlows version) is low on multi-author WordPress sites. The main limiting factor is that an attacker must already hold a Contributor (or higher) account, which narrows opportunistic mass exploitation to sites that allow untrusted registration or contributor signups. Data is single-source (Patchstack) with a sparse description that names neither the vulnerable parameter nor the include sink; the CVSS vector is the primary technical signal and should be treated as vendor/Patchstack-supplied rather than independently confirmed.

An attacker registers or obtains a Contributor-level account on a WordPress site running CartFlows <= 3.2.0, then sends a crafted authenticated request that manipulates a filename passed to a PHP include/require, causing the server to include and execute attacker-influenced PHP. This yields remote code execution in the web server context and full compromise of the site. No public proof-of-concept was provided in the input.