PhoenixCart Vulnerable to Account Deletion Without Password Confirmation

published 2025-06-02 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16648

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session (e.g., on a shared/public machine) could permanently delete the user’s account without knowledge of the password. This bypass of re-authentication puts users at risk of account loss and data disruption. Version 1.1.0.3 contains a patch for the issue.

Patch / fix

fixed in 1 links 1

phoenixcart ce_phoenix_cart 1.1.0.3

github.com/CE-PhoenixCart/PhoenixCart@e87162b commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 17 mo ago (2025-06-02)

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

CE-PhoenixCart PhoenixCart

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

Sources

CVE List CVE-2025-47272
NVD CVE-2025-47272

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary