CVE-2023-47444: Opencart

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server.

Affected products

• Opencart Opencart: from 4.0.0.0, up to and including 4.0.2.3

Published 2023-11-15. Last modified 2026-06-17.