# CVE-2026-41875: Quick.Cart Cross-Site Request Forgery in admin panel

Source: https://junglewise.ai/threats/cve-2026-41875-quick-cart-is-vulnerable-to-cross-site-request-forgery-in-admin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-41875 · Severity: info · Published 2026-09-29

Quick.Cart is a PHP shopping cart script used to create online stores. A Cross-Site Request Forgery (CSRF) vulnerability in the admin configuration panel allows an attacker to craft a malicious website that, when visited by an administrator, automatically changes the admin's login credentials. The software's built-in protection can be bypassed by manipulating the referrer header, putting all forms in the application at risk.

Vendors: [OpenSolution](https://junglewise.ai/threats/vendors/opensolution).

## Quick answers

**Is CVE-2026-41875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41875 being exploited in the wild.

**How severe is CVE-2026-41875?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** OpenSolution Quick.Cart all versions up to 6.7.0.

**Is there a fix for CVE-2026-41875?** A patch was published on 2026-11-09: Version 6.7 patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41875 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-41875?** Check whether you run OpenSolution Quick.Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Quick.Cart contains a CSRF vulnerability in the admin panel where referer-based CSRF protection can be bypassed through header manipulation. An unauthenticated attacker can craft a malicious webpage that, when visited by an authenticated admin, triggers forged POST requests (e.g., to reset admin credentials) without user interaction. The vulnerability affects all versions up to 6.7.0; it was patched in version 6.7 released on 2026-11-09.

## Affected products

- OpenSolution Quick.Cart all versions up to 6.7.0

## Timeline

- 2026-09-29: disclosed
- 2026-11-09: patched: Version 6.7 patch released

## References

- [https://cert.pl/posts/2026/09/CVE-2026-41875/](https://cert.pl/posts/2026/09/CVE-2026-41875/)
- [https://opensolution.org/shopping-cart-quick-cart.html](https://opensolution.org/shopping-cart-quick-cart.html)

## Related threats

- [OpenSolution Quick.Cart plaintext admin credentials in configuration file](https://junglewise.ai/threats/cve-2026-41874-opensolution-quick-cart-plaintext-admin-credentials-in)