Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47946OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery

Medium 5.3

In plain English

A medium-severity cross-site request forgery in OpenCart from Opencart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 95.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and account information, then use password reset functionality to gain unauthorized access to compromised accounts.

Affected products (as reported)

Vendor	Product	Versions
Opencart	OpenCart	3.0.3.6

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

ExploitDB-49407 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: OpenCart 3.0.36 Account Takeover via Cross Site Request Forgery third-party-advisory