Code Injection Vulnerability in Zen Cart Administrative Module by Zen Cart
CVE-2026-108827

2.1LOW

Key Information:

Vendor: Zen Cart
Status: Zen Cart
Vendor: CVE Published:; 12 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108827?

A code injection vulnerability exists in the Administrative Module Management of Zen Cart versions up to 2.2.2, specifically within the zen_call_function function found in admin/includes/functions/general.php. This flaw allows attackers to manipulate the 'use_function' argument, leading to potential code execution capabilities. Although the exploit requires complex conditions to be met—such as access through the SQL Patch tool or pre-existing SQL injection vulnerabilities—the risk remains heightened due to the public disclosure of the exploit. Users are advised to review their security posture and apply best practices to mitigate any potential exploitation.

Affected Version(s)

Zen Cart 2.2.0

Zen Cart 2.2.1

Zen Cart 2.2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108827 - Proof of Concept