Remote Code Execution Vulnerability in WebKul Bagisto E-Commerce Platform
CVE-2025-56426

6.5MEDIUM

Key Information:

Vendor

WebKul

Status
Bagisto
Vendor
CVE Published:
9 October 2025

What is CVE-2025-56426?

A vulnerability in WebKul Bagisto version 2.3.6 allows remote attackers to execute arbitrary code through the Cart/Checkout API endpoint. This issue arises because the price calculation logic does not properly validate quantity inputs, potentially leading to manipulation of the application’s behavior by entering malicious data.

References

https://medium.com/@rudranshsinghrajpurohit/cve-2025-5642...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.