Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121628Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
Low 3.7
In plain English
A low-severity race condition in bagisto from bagisto. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 80.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650 patch
- Patch Commit patch
- bagisto v2.3.16 Release Notes release-notes
- bagisto v2.4.1 Release Notes release-notes
- https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195 exploit
- https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95 technical-description
- https://github.com/bagisto/bagisto product
- VulnCheck Advisory: Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting third-party-advisory