CVE-2026-19837
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A weakness has been identified in Webkul Bagisto up to 2.4.4 in the file /admin/customers/search of the Customer Search component. Manipulating the Query argument can lead to information disclosure. The attack can be launched remotely, and the exploit is publicly available. The vendor confirms that the issues are already known and partially addressed.
Risk Assessment
The risk is the potential remote disclosure of sensitive information through manipulation of the query in the customer search. The publicly available exploit increases the likelihood of attack.
Recommendation
Upgrade to the latest version of Bagisto that includes fixes. Also monitor vendor announcements for planned patches and apply them once released.
Original NVD description (English source)
A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."