CVE-2026-54642: Cubecart v6

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens. This issue is fixed in version 6.7.5.

Affected products

• Cubecart v6: before 6.7.5 (fixed in 6.7.5)

Published 2026-09-17. Last modified 2026-09-24.