CVE-2026-46408
HighSummary
Vvveb is a powerful and easy to use content management system (CMS) that had a vulnerability in the checkout endpoint prior to version 1.0.8.3. It allowed logged-in attackers to reuse another user's cart data in their own checkout session.
Risk Assessment
Attackers could exploit this vulnerability to take over another user's cart data, leading to unauthorized transactions and breaches of user privacy.
Recommendation
It is recommended to upgrade to version 1.0.8.3 or later to mitigate this vulnerability and secure the checkout process.
Original NVD description (English source)
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3.