CVE-2026-54643: Cubecart v6

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.

Affected products

• Cubecart v6: before 6.7.5 (fixed in 6.7.5)

Published 2026-09-17. Last modified 2026-09-23.