Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password… (CVE-2026-93949)

CVE-2026-93949 describes an authentication bypass vulnerability in Omegathemes Grocery Shopping Store versions up to 1.3.3. The issue involves exploitation of the password recovery functionality through an alternate path or channel, allowing attackers with some privileges to bypass normal authentication controls. The vulnerability is classified under CWE-288 (Authentication Bypass by Alternate Path or Channel). The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation could allow an attacker to bypass authentication controls related to password recovery, potentially leading to unauthorized modification of data or disruption of service (availability impact). There is no direct confidentiality impact reported. The attack requires network access and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available information. Until a patch is available, restrict access to the password recovery functionality and monitor for suspicious activity related to authentication bypass attempts.