CVE-2026-75081
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/account/rma/store, involving enforcement of behavioral workflow. Manipulation of the rma_qty/resolution_type/rma_reason_id arguments allows remote attack. The exploit is now public and may be used. The vendor confirms the issues were already identified internally and are being addressed.
Risk Assessment
An attacker can remotely alter the RMA process flow, potentially leading to unauthorized changes in orders, policy violations, or fraud. The public exploit increases the risk.
Recommendation
Update Bagisto to the latest version when available, and validate/restrict the values of rma_qty/resolution_type/rma_reason_id. Temporarily restrict access to RMA functionality if possible.
Original NVD description (English source)
A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_qty/resolution_type/rma_reason_id results in enforcement of behavioral workflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."