Is CVE-2025-13004 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13004 being exploited in the wild.

How severe is CVE-2025-13004?

Medium severity, with a CVSS score of 6.3, published 12 February 2026.

Which products and versions are affected?

Farktor Software E-Commerce Services Inc. E-Commerce Package through 27112025.

Is there a fix for CVE-2025-13004?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13004 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-13004?

Check whether you run Farktor E-Commerce Package. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13004: Farktor Software E-Commerce Package auth bypass in user-controlled variables

CVE-2025-13004 · Severity: medium · CVSS 6.3 · Published 2026-02-12

Farktor Software's E-Commerce Package, a platform used for managing online retail operations, contains a security flaw that allows users to bypass authorization checks. By manipulating specific data keys or variables, an attacker could potentially modify information they are not authorized to access. This could lead to unauthorized changes in order details, customer profiles, or other sensitive business data, impacting the integrity of the e-commerce operations.

Technologies: Farktor E-Commerce Package. Vendors: Farktor.

Quick answers

Is CVE-2025-13004 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13004 being exploited in the wild.
How severe is CVE-2025-13004?: Medium severity, with a CVSS score of 6.3, published 12 February 2026.
Which products and versions are affected?: Farktor Software E-Commerce Services Inc. E-Commerce Package through 27112025.
Is there a fix for CVE-2025-13004?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13004 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-13004?: Check whether you run Farktor E-Commerce Package. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability exists in the Farktor Software E-Commerce Package through version 27112025. The flaw resides in how the application handles user-provided keys or variables, failing to properly validate that the requesting user has the authority to access or modify the object associated with that key. An attacker with low-privileged credentials can exploit this over the network, though it may require some user interaction. Successful exploitation allows the attacker to manipulate variables and bypass security logic to perform unauthorized data modifications.

Affected products

Farktor Software E-Commerce Services Inc. E-Commerce Package through 27112025

Timeline

2026-02-12: advisory: Initial disclosure by TR-CERT (USOM)
2026-02-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.