CVE-2026-121628 — Vulnerability intelligence
—
Published:
- CVSS
- 6.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.