CVE-2026-79411

In Webkul Bagisto v2.4.9, improper validation of the quantity parameter in the add-to-cart path allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.

An authorization bypass vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/sales/rma/requests (Backend Sales RMA Endpoint). Manipulation allows remote authorization bypass. The exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

A vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/customers (Backend Customer Behavior Data Endpoint). Manipulation of the ID argument leads to improper privilege management. The attack can be executed remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

Cross-site scripting vulnerability in Webkul Bagisto up to 2.4.4, in the file /customer/account/rma/send-message of the RMA Message Handler component. Manipulation of the Message argument allows remote script execution in the browser. The exploit has been publicly disclosed.

An authorization bypass vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/configuration/cache-management/execute (Configuration Management). Manipulation of the action argument leads to authorization bypass. The attack may be launched remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

A vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /customer/account/rma/update-status (RMA State Validation). Manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. The issue affects unknown code in /admin/reporting/sales/ of the Backend Reporting Endpoint, leading to authorization bypass. Remote exploitation is possible, and the exploit is publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.

A weakness has been identified in Webkul Bagisto up to 2.4.4 in the file /admin/customers/search of the Customer Search component. Manipulating the Query argument can lead to information disclosure. The attack can be launched remotely, and the exploit is publicly available. The vendor confirms that the issues are already known and partially addressed.

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. The issue affects unknown functionality in /admin/customers/view of the Backend Customer Detail Feature. Manipulation of the ID argument results in authorization bypass. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues are already addressed, while others are planned for future releases.