PT-2026-40813 · Cubecart · Cubecart

Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-45055

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CubeCart versions 6.6.x through 6.7.1

Description CubeCart builds the CC STORE URL constant directly from the Host request header during bootstrap without using an allowlist. This constant is embedded into transactional email links, specifically the password-reset links generated by the passwordRequest() functions in the User and Admin classes. An unauthenticated attacker can send a request to the '/index.php? a=recover' endpoint with a malicious Host header. This causes the system to send an email to the victim containing a link that points to the attacker's domain while containing a valid verification token. If the victim clicks the link, the attacker can capture the token, leading to full account or store takeover.

Recommendations Update to version 6.7.2.

Exploit

Fix

Open Redirect

RCE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-601

CWE-20

CWE-345

CWE-784

Related Identifiers

CVE-2026-45055

Affected Products

Cubecart

References · 4

• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-7pvc-gxc4-chmc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45055 · Security Note
• https://twitter.com/CVEnew/status/2054709211590996171 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054855184447082780 · Twitter Post