Race Condition Vulnerability in Bagisto eCommerce Platform
CVE-2026-121628

6.3MEDIUM

Key Information:

Vendor: Bagisto
Status: Bagisto
Vendor: CVE Published:; 3 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-121628?

The Bagisto eCommerce platform versions prior to 2.3.16 and 2.4.1 are vulnerable to a race condition in the manageCartRule() function. This vulnerability allows attackers to exploit single-use coupons by submitting concurrent order requests. As a result, attackers can bypass existing checks in the system, enabling them to apply discounts on multiple transactions instead of just once. This can lead to significant financial loss for businesses relying on these discount mechanisms. It is crucial for users to update their Bagisto installations to the latest versions to mitigate this risk and ensure secure operations.

Affected Version(s)

bagisto 0 < 2.3.16

bagisto 2.4.0 < 2.4.1

bagisto 2.3.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-121628 - Proof of Concept