CVE-2026-96603 describes an authorization bypass vulnerability in the Abdurrab5 online-makeup-store software. The flaw exists in the confirm_logged_in/confirm_user function within the Admin Handler component's functions.php file. By manipulating the adminid argument, an attacker can bypass authorization checks remotely. The vulnerability is classified under CWE-862 (Missing Authorization). The product's rolling release model means no specific affected or fixed versions are provided. The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating remote exploitability with low attack complexity and no privileges or user interaction required. The vendor was contacted early, but no patch or remediation details are currently available. Public disclosure of the exploit exists, but no active exploitation in the wild is confirmed.

Successful exploitation allows remote attackers to bypass authorization controls, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. This could enable attackers to perform actions reserved for authorized administrators, compromising the system's security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product uses a rolling release system and no patch information is provided, monitor vendor communications for updates. In the meantime, consider restricting remote access to the affected component if possible and apply compensating controls to limit exposure.