Medium severity · published Sep 17, 2026
CVE-2026-54642
CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens. This issue is fixed in version 6.7.5.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V6
v6 · cubecart
< 6.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54642
github.com
https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
github.com
https://github.com/cubecart/v6/commit/204122caa136f5be33f239d7f1ffa5775071025d
github.com
https://github.com/cubecart/v6/releases/tag/6.7.5
github.com
https://github.com/cubecart/v6/security/advisories/GHSA-cq6g-rf5m-42xg
More from v6
9.1
CVE-2026-45714
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
9.1
CVE-2026-45053
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
9.1
CVE-2026-44377
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
8.1
CVE-2026-45055
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
7.2
CVE-2026-54647
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php