Is CVE-2026-54642 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54642 being exploited in the wild.

How severe is CVE-2026-54642?

Informational severity, published 17 September 2026.

Is there a fix for CVE-2026-54642?

A patch was published on 2026-09-17: Fixed in CubeCart 6.7.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54642 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54642?

Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54642: CubeCart CSRF on order download-counter reset and stored-card deletion

CVE-2026-54642 · Severity: info · Published 2026-09-17

CubeCart is an e-commerce platform that manages online stores, product catalogs, and customer payments. Prior to version 6.7.5, two administrative functions—resetting electronic download usage counters and deleting stored payment card tokens—lacked proper request forgery protection. An attacker could trick an authenticated store administrator into performing these actions unknowingly, resulting in loss of customer payment data or disruption of digital product delivery.

Technologies: CubeCart. Vendors: CubeCart.

Quick answers

Is CVE-2026-54642 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54642 being exploited in the wild.
How severe is CVE-2026-54642?: Informational severity, published 17 September 2026.
Which products and versions are affected?: CubeCart before 6.7.5.
Is there a fix for CVE-2026-54642?: A patch was published on 2026-09-17: Fixed in CubeCart 6.7.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54642 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54642?: Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in CubeCart's admin interface. Two state-changing actions—reset_id (download-counter reset) and delete_card (stored-payment-card deletion)—were implemented as GET requests without CSRF token validation. These actions were omitted from the CSRF protection map in admin/skins/default/csrf.inc.php and vulnerable code was in admin/sources/orders.index.inc.php. An attacker can craft a malicious webpage containing an image tag or link that, when visited by an authenticated admin, triggers the request without a validated session token. The attack requires an active admin session but no additional authentication or user interaction beyond clicking a link or visiting a page. The fix, released in version 6.7.5, adds CSRF protection by validating session tokens and updating the CSRF map to include these actions.

Affected products

CubeCart CubeCart before 6.7.5

Timeline

2026-09-17: disclosed: CVE-2026-54642 published
2026-09-17: patched: Fixed in CubeCart 6.7.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.