CVE-2026-96603

Received Received - Intake

Missing Authorization in Abdurrab5 Online Makeup Store

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-96603

Affected Vendors & Products

Vendor	Product	Version / Range
abdurrab5	online-makeup-store	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Abdurrab5 online-makeup-store software. It is located in the confirm_logged_in/confirm_user function of the functions.php file within the Admin Handler component. The issue arises when the adminid argument is manipulated, leading to missing authorization checks. This allows unauthorized remote access to sensitive admin functions.

Impact Analysis

An attacker could exploit this to gain unauthorized access to admin privileges, potentially allowing them to modify store settings, access customer data, or perform other administrative actions without proper authorization. The remote attack vector increases the risk as it can be executed from anywhere.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised user or customer data.

Mitigation Strategies

Immediately restrict access to the confirm_logged_in/confirm_user function in functions.php. Review and update authorization checks for the adminid parameter to ensure proper validation. Monitor network traffic for unusual activity targeting this component.

Hi! I’m here to help you understand CVE-2026-96603. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70