Is CVE-2026-115450 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115450 being exploited in the wild.

How severe is CVE-2026-115450?

Informational severity, published 22 October 2026.

Which products and versions are affected?

MarcosCamara01 Ecommerce Template from commit 2aa8ec53 (16 November 2025) to commit e6b364cd (31 July 2026).

How is CVE-2026-115450 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-115450?

Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115450: MarcosCamara01 Ecommerce Template price manipulation in checkout

CVE-2026-115450 · Severity: info · Published 2026-10-22

The Ecommerce Template is a web application that handles shopping carts and payment processing through Stripe. An authenticated user can manipulate prices by paying for a cheap product while receiving an expensive one, allowing unlimited repeated fraud with valid Stripe charges that record incorrect order amounts. Store operators face direct financial loss from unpaid orders that appear legitimate in their records.

Technologies: MarcosCamara01 Ecommerce Template. Vendors: MarcosCamara01.

Quick answers

Is CVE-2026-115450 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115450 being exploited in the wild.
How severe is CVE-2026-115450?: Informational severity, published 22 October 2026.
Which products and versions are affected?: MarcosCamara01 Ecommerce Template from commit 2aa8ec53 (16 November 2025) to commit e6b364cd (31 July 2026).
Is there a fix for CVE-2026-115450?: Yes: fixed in commit e6b364cd of 31 July 2026. Until then: No configuration-based mitigation exists in affected revisions because the vulnerable stripeId field is accepted from the request body on every add-to-cart operation. Upgrade to the patched commit immediately.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22", "note": "CVE-2026-115450 published"}, {"kind": "patched", "at": "2026-07-31", "note": "commit e6b364cd merged"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115450 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-115450?: Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: commit e6b364cd of 31 July 2026

No configuration-based mitigation exists in affected revisions because the vulnerable stripeId field is accepted from the request body on every add-to-cart operation. Upgrade to the patched commit immediately.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-22", "note": "CVE-2026-115450 published"}, {"kind": "patched", "at": "2026-07-31", "note": "commit e6b364cd merged"}]

Technical details

An external control vulnerability (CWE-472) exists in POST /api/user/cart and POST /api/stripe/payment: the cart endpoint accepts both variantId (what to order) and stripeId (what to charge) as independent client-supplied fields with no server validation that they correspond. The payment endpoint builds Stripe line items from the stored stripeId while the webhook creates order records from variantId, causing charge and fulfillment to diverge. All catalogue price IDs are publicly readable, eliminating any guessing requirement.

Affected products

MarcosCamara01 Ecommerce Template from commit 2aa8ec53 (16 November 2025) to commit e6b364cd (31 July 2026)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.