# CVE-2026-19993: Webkul Bagisto RMA state validation bypass

Source: https://junglewise.ai/threats/cve-2026-19993-webkul-bagisto-rma-state-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19993 · Severity: medium · CVSS 4.3 · Published 2026-08-17

Webkul Bagisto is an open-source e-commerce platform that includes a Return Merchandise Authorization (RMA) system for managing customer returns and refunds. A flaw in the RMA state management allows customers to bypass business logic rules and force-close or cancel return requests in states where the web interface should block these actions. This enables customers to prematurely terminate support workflows, potentially disrupting after-sales operations and creating audit trail inconsistencies.

Technologies: [Webkul Bagisto](https://junglewise.ai/threats/technologies/bagisto). Vendors: [Webkul](https://junglewise.ai/threats/vendors/webkul).

## Quick answers

**Is CVE-2026-19993 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19993 being exploited in the wild.

**How severe is CVE-2026-19993?** Medium severity, with a CVSS score of 4.3, published 17 August 2026.

**Which products and versions are affected?** Webkul Bagisto up to 2.4.4.

**Is there a fix for CVE-2026-19993?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19993 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19993?** Check whether you run Webkul Bagisto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side business logic bypass in the RMA state validation mechanism. The backend endpoints /customer/account/rma/update-status and /customer/account/rma/cancel do not fully validate whether state transitions are allowed in the current RMA state; they only check ownership and basic conditions. An authenticated customer can craft direct POST requests to force an RMA from states like DECLINED to SOLVED or cancel an already-solved request, actions the frontend explicitly prevents by hiding the relevant UI controls. The vulnerability requires authentication and remote network access. The impact is workflow manipulation and integrity compromise rather than data exposure, though it can create confusion in support operations and corrupt audit logs.

## Affected products

- Webkul Bagisto up to 2.4.4

## Timeline

- 2026-08-17: disclosed
- 2026-08-17: advisory

## References

- [https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/37_38_english_vulnerability_report.md](https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/37_38_english_vulnerability_report.md)
- [https://vuldb.com/cve/CVE-2026-19993](https://vuldb.com/cve/CVE-2026-19993)

## Related threats

- [Webkul Bagisto privilege escalation in user-management](https://junglewise.ai/threats/cve-2026-79411-webkul-bagisto-privilege-escalation-in-user-management)
- [Webkul Bagisto improper quantity validation in add-to-cart](https://junglewise.ai/threats/cve-2026-79410-webkul-bagisto-improper-quantity-validation-in-add-to-cart)
- [Webkul Bagisto information disclosure in add-to-cart API](https://junglewise.ai/threats/cve-2026-79409-webkul-bagisto-information-disclosure-in-add-to-cart-api)
- [Bagisto path traversal in ImageCacheController](https://junglewise.ai/threats/cve-2026-9506-bagisto-path-traversal-in-imagecachecontroller)