CVE-2026-54642

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5

Description Cross-Site Request Forgery (CSRF) occurs when an application allows a user to perform actions without verifying that the request was intentionally initiated by the user. In the file admin/sources/orders.index.inc.php, the reset id download-counter action and delete card stored-payment-card action use state-changing GET requests and are missing from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can trick an authenticated administrator into executing these requests without a validated session token, leading to the unauthorized reset of electronic download usage counters or the deletion of stored customer payment-card tokens.

Recommendations Update to version 6.7.5.