Executive brief
SimplCommerce, an open-source e-commerce platform, is vulnerable to an attack that could allow unauthorized users to create or change news articles on the site. By tricking a logged-in administrator into clicking a malicious link or visiting a compromised webpage, an attacker can perform administrative actions without the manager's knowledge. This could lead to the spread of misinformation or unauthorized content changes on the storefront.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the NewsItemApiController of SimplCommerce due to the absence of anti-forgery token validation. The vulnerability is rooted in the accidental removal or commenting out of the CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter in previous versions. An unauthenticated remote attacker can exploit this by inducing an authenticated administrator to submit a crafted request to the `/api/news-items` endpoint. Successful exploitation allows the attacker to create, modify, or potentially delete news items with administrative privileges. The issue was addressed in commit 6233d73e by restoring the anti-forgery authorization filter.
Affected products
- SimplCommerce SimplCommerce prior to commit 6233d73e
Timeline
- 2026-05-25: patched: Fix merged via pull request 1150
- 2026-06-17: disclosed: CVE published