AI Threat AlertCVE-2026-41875: Quick.Cart: CSRF in admin panel allows credential takeover
UNKNOWNQuick.Cart, a PHP shopping cart, has a cross-site request forgery flaw in its admin configuration panel. A malicious web page can make an admin's browser silently submit a POST that changes the admin login and password, and the built-in Referer-header check is easily bypassed. The product is not an AI/ML system, and the AI classification (ml_ui) looks like a false positive, so the exposure for AI programs is limited to cases where a Quick.Cart store sits next to AI workloads or shares credentials with them. Exploitation likelihood is low to moderate: EPSS is 0.00166 (top 95th percentile), there is no public exploit, no Nuclei template, no KEV listing, and CISA SSVC says TRACK. No CVSS score has been published, and the downstream dependent count is unknown. Apply the vendor patch to version 6.7 (the advisory's date is ambiguous, so confirm the patch level with the vendor), restrict admin panel access by IP or VPN, and have admins use a separate browser profile for administration.
What is the risk?
Overall risk is MEDIUM for Quick.Cart operators and LOW for AI/ML programs. Exploitation needs an admin to visit an attacker-controlled page while logged in, but then no further interaction is required and the result is full admin takeover. The Referer-based defense is bypassable. All forms are potentially affected, so the issue is broader than the password-change form. There is no known active exploitation, no public PoC and no KEV listing. No CVSS score has been published, so any severity rating here is analyst judgment, not vendor data. Confidence: MEDIUM, based on the NVD description and the CERT.pl advisory.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Quick.Cart | — | — | No patch |
Do you use Quick.Cart? You're affected.
How severe is it?
What should I do?
6 stepsApply the vendor patch for Quick.Cart 6.7 and confirm the patch level with the vendor, since the advisory date is ambiguous.
Restrict the admin panel to trusted IPs or a VPN, or put it behind HTTP basic auth or a reverse proxy.
Have admins use a dedicated browser profile and log out after administrative work.
Add SameSite=Strict cookies and a CSRF-token check at a WAF or reverse proxy if the application cannot be modified.
Detect by monitoring for admin credential changes, POSTs to config endpoints with external or missing Referer headers, and unexpected admin logins.
Rotate admin credentials and review the store for unauthorized changes if exposure is suspected.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-41875?
Quick.Cart, a PHP shopping cart, has a cross-site request forgery flaw in its admin configuration panel. A malicious web page can make an admin's browser silently submit a POST that changes the admin login and password, and the built-in Referer-header check is easily bypassed. The product is not an AI/ML system, and the AI classification (ml_ui) looks like a false positive, so the exposure for AI programs is limited to cases where a Quick.Cart store sits next to AI workloads or shares credentials with them. Exploitation likelihood is low to moderate: EPSS is 0.00166 (top 95th percentile), there is no public exploit, no Nuclei template, no KEV listing, and CISA SSVC says TRACK. No CVSS score has been published, and the downstream dependent count is unknown. Apply the vendor patch to version 6.7 (the advisory's date is ambiguous, so confirm the patch level with the vendor), restrict admin panel access by IP or VPN, and have admins use a separate browser profile for administration.
Is CVE-2026-41875 actively exploited?
No confirmed active exploitation of CVE-2026-41875 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-41875?
1. Apply the vendor patch for Quick.Cart 6.7 and confirm the patch level with the vendor, since the advisory date is ambiguous. 2. Restrict the admin panel to trusted IPs or a VPN, or put it behind HTTP basic auth or a reverse proxy. 3. Have admins use a dedicated browser profile and log out after administrative work. 4. Add SameSite=Strict cookies and a CSRF-token check at a WAF or reverse proxy if the application cannot be modified. 5. Detect by monitoring for admin credential changes, POSTs to config endpoints with external or missing Referer headers, and unexpected admin logins. 6. Rotate admin credentials and review the store for unauthorized changes if exposure is suspected.
What systems are affected by CVE-2026-41875?
This vulnerability affects the following AI/ML architecture patterns: web storefront admin panels, e-commerce platforms with AI chatbot or recommendation integrations.
What is the CVSS score for CVE-2026-41875?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0078Drive-by CompromiseCompliance Controls Affected
What are the technical details?
Original Advisory
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable
Exploitation Scenario
An attacker hosts a page, or sends a phishing link, containing a hidden auto-submitting form aimed at the Quick.Cart admin config endpoint. A logged-in admin opens it, and the browser sends a forged POST that sets a new admin login and password. The attacker spoofs or strips the Referer header to defeat the weak protection. The attacker then logs in as admin, alters the store, and may pivot to any connected systems, such as an AI chatbot or analytics integration. This scenario is generic web exploitation, not AI-specific.
Weaknesses (CWE)
CWE-352 — Cross-Site Request Forgery: The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330] Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
- [Implementation] Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Source: MITRE CWE corpus.
References
- cert.pl/posts/2026/09/CVE-2026-41875/third-party-advisory
- opensolution.org/shopping-cart-quick-cart.htmlproduct
Timeline
Related Vulnerabilities
CVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same attack type: Auth BypassGHSA-vvpj-8cmc-gx3910.0picklescan: security flaw enables exploitation
Same attack type: Auth BypassCVE-2025-5376710.0Azure OpenAI: SSRF EoP, no auth required (CVSS 10)
Same attack type: Auth BypassCVE-2025-282810.0LangChain RequestsToolkit: SSRF exposes cloud metadata
Same attack type: Auth BypassCVE-2026-2603010.0semantic-kernel: Code Injection enables RCE
Same attack type: Auth Bypass