Is CVE-2026-41875 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41875 being exploited in the wild.

How severe is CVE-2026-41875?

Informational severity, published 29 September 2026.

Which products and versions are affected?

OpenSolution Quick.Cart all versions up to 6.7.0.

Is there a fix for CVE-2026-41875?

A patch was published on 2026-11-09: Version 6.7 patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41875 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-41875?

Check whether you run OpenSolution Quick.Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41875: Quick.Cart Cross-Site Request Forgery in admin panel

CVE-2026-41875 · Severity: info · Published 2026-09-29

Quick.Cart is a PHP shopping cart script used to create online stores. A Cross-Site Request Forgery (CSRF) vulnerability in the admin configuration panel allows an attacker to craft a malicious website that, when visited by an administrator, automatically changes the admin's login credentials. The software's built-in protection can be bypassed by manipulating the referrer header, putting all forms in the application at risk.

Vendors: OpenSolution.

Quick answers

Is CVE-2026-41875 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41875 being exploited in the wild.
How severe is CVE-2026-41875?: Informational severity, published 29 September 2026.
Which products and versions are affected?: OpenSolution Quick.Cart all versions up to 6.7.0.
Is there a fix for CVE-2026-41875?: A patch was published on 2026-11-09: Version 6.7 patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41875 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-41875?: Check whether you run OpenSolution Quick.Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Quick.Cart contains a CSRF vulnerability in the admin panel where referer-based CSRF protection can be bypassed through header manipulation. An unauthenticated attacker can craft a malicious webpage that, when visited by an authenticated admin, triggers forged POST requests (e.g., to reset admin credentials) without user interaction. The vulnerability affects all versions up to 6.7.0; it was patched in version 6.7 released on 2026-11-09.

Affected products

OpenSolution Quick.Cart all versions up to 6.7.0

Timeline

2026-09-29: disclosed
2026-11-09: patched: Version 6.7 patch released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.