Is CVE-2021-47946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-47946 being exploited in the wild.

How severe is CVE-2021-47946?

Medium severity, with a CVSS score of 5.3, published 10 May 2026.

Is there a fix for CVE-2021-47946?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-47946 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2021-47946?

Check whether you run OpenCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47946: OpenCart CSRF in account edit endpoint

CVE-2021-47946 · Severity: medium · CVSS 5.3 · Published 2026-05-10

OpenCart, a popular open-source e-commerce platform, is vulnerable to a security flaw that allows attackers to take over customer accounts. By tricking a logged-in user into visiting a malicious website, an attacker can silently change the user's email address and account details. Once the email is changed, the attacker can use the standard password reset feature to gain full control of the account, potentially accessing personal data and order history.

Technologies: OpenCart. Vendors: OpenCart.

Quick answers

Is CVE-2021-47946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-47946 being exploited in the wild.
How severe is CVE-2021-47946?: Medium severity, with a CVSS score of 5.3, published 10 May 2026.
Which products and versions are affected?: OpenCart <= 3.0.3.6.
Is there a fix for CVE-2021-47946?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-47946 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2021-47946?: Check whether you run OpenCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in OpenCart versions up to and including 3.0.3.6 within the '/account/edit' endpoint. The application fails to properly validate CSRF tokens when updating user profile information. An unauthenticated remote attacker can exploit this by inducing a logged-in user to visit a malicious webpage containing a crafted payload. This payload can modify the victim's account details, specifically the registered email address. Once the email is changed to one controlled by the attacker, they can initiate a password reset to achieve full account takeover. Proof-of-concept exploits have been publicly disclosed.

Affected products

OpenCart OpenCart <= 3.0.3.6

Timeline

2021-01-09: disclosed: Original discovery and exploit publication by Mahendra Purbia
2026-05-10: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.