Is CVE-2026-120853 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120853 being exploited in the wild.

How severe is CVE-2026-120853?

Medium severity, with a CVSS score of 5.3, published 7 November 2026.

Which products and versions are affected?

Brainstorm Force CartFlows through 3.3.0.

Is there a fix for CVE-2026-120853?

Yes: fixed in 3.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120853 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-120853?

Check whether you run Brainstorm Force CartFlows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120853: Brainstorm Force CartFlows broken access control

CVE-2026-120853 · Severity: medium · CVSS 5.3 · Published 2026-11-07

CartFlows is a WordPress plugin that helps businesses create sales funnels and checkout flows. A broken access control vulnerability allows unauthenticated users to access pages or perform actions they should not be permitted to, such as viewing other users' data. This could expose sensitive customer information or allow unauthorized cart and order manipulation on e-commerce sites.

Technologies: Brainstorm Force CartFlows. Vendors: Brainstorm Force.

Quick answers

Is CVE-2026-120853 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120853 being exploited in the wild.
How severe is CVE-2026-120853?: Medium severity, with a CVSS score of 5.3, published 7 November 2026.
Which products and versions are affected?: Brainstorm Force CartFlows through 3.3.0.
Is there a fix for CVE-2026-120853?: Yes: fixed in 3.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120853 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-120853?: Check whether you run Brainstorm Force CartFlows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.1

Technical details

The vulnerability is a broken access control issue in CartFlows versions through 3.3.0 that permits unauthenticated attackers to access restricted pages and perform unauthorized actions. No specific attack vector details are disclosed beyond the OWASP A1 classification. The vulnerability requires no authentication and has been patched in version 3.3.1.

Affected products

Brainstorm Force CartFlows through 3.3.0

Timeline

2026-10-29: disclosed: Reported by Filip Kowalski
2026-11-07: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.