CVE-2026-75081
Received Received - Intake

Stored XSS in Webkul Bagisto via RMA Form Input

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulDB

Description
A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_qty/resolution_type/rma_reason_id results in enforcement of behavioral workflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75081
EUVD
EUVD-2026-60558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-840 Business Logic Errors
CWE-841 The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Webkul Bagisto up to version 2.4.4 involves business logic validation issues in the Return Merchandise Authorization (RMA) creation process. Attackers can manipulate request parameters like rma_qty, resolution_type, and rma_reason_id to bypass server-side validation. The frontend enforces rules via UI validation, but the backend fails to revalidate these constraints before storing RMA records.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the /customer/account/rma/store endpoint for unusual parameter modifications. Check for requests where rma_qty exceeds limits, resolution_type is invalid, or rma_reason_id does not match the selected resolution type. Use network inspection tools like Wireshark or browser developer tools to capture and analyze these requests.

Impact Analysis

This vulnerability allows attackers to create semantically inconsistent RMA records by submitting excessive quantities, invalid resolution types, or mismatched reason IDs. This can disrupt workflows, mislead customer service, and cause incorrect processing in backend systems like refunds or cancellations.

Compliance Impact

This vulnerability primarily impacts data integrity and workflow consistency in the RMA process. It does not directly violate GDPR or HIPAA but could indirectly affect compliance by enabling incorrect processing of customer returns, refunds, or cancellations. Such inconsistencies might lead to improper handling of personal or health-related data, potentially violating GDPR's accuracy principle or HIPAA's integrity requirements if sensitive data is involved.

Mitigation Strategies

Immediately implement server-side validation for the RMA creation process to enforce business rules such as quantity limits, valid resolution types, and reason-to-resolution mappings. Ensure all frontend validations are mirrored on the backend before storing RMA records. Update to the latest Bagisto version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart