A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_qty/resolution_type/rma_reaso…
Medium CVSS 4.3
Summary
A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_qty/resolution_type/rma_reason_id results in enforcement of behavioral workflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/34_36_english_vulnerability_report.md
- https://vuldb.com/cve/CVE-2026-75081
- https://vuldb.com/submit/870359
- https://vuldb.com/vuln/391309
- https://vuldb.com/vuln/391309/cti
Timeline
- nvd_ingest NVD