CVE-2026-115450: CWE-472 External Control of Assumed-Immutable Web Parameter in MarcosCamara01 Ecommerce Template
Description
CVE-2026-115450 is a vulnerability in the MarcosCamara01 Ecommerce Template that allows an authenticated user without special privileges to manipulate the checkout process. The flaw arises because the cart API accepts separate parameters for the product variant and the Stripe price ID without verifying their consistency. This enables an attacker to pay the price of one product while ordering a different, potentially more expensive product. The vulnerability allows repeated exploitation to purchase goods at the price of the cheapest item in the catalogue, causing order records to mismatch the actual payment amount.
CVSS v4.0
Score 7.1high
Affected software
MarcosCamara01
Ecommerce Template
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CWE-472) in MarcosCamara01 Ecommerce Template's cart and checkout flow stems from the POST /api/user/cart endpoint accepting two independent fields: variantId (which determines the product ordered) and stripeId (which determines the Stripe price charged). These values are stored together without validation that the stripeId corresponds to the variantId. Consequently, POST /api/stripe/payment charges the Stripe price indicated by stripeId, while the order records the product identified by variantId. Since all stripeId values are publicly readable, an attacker can select a cheaper stripeId to pay less while ordering a different product. This discrepancy leads to orders where the payment amount does not match the product purchased, enabling financial loss to the merchant.
Potential Impact
An authenticated user can exploit this vulnerability to pay the price of a cheaper product while ordering a different, potentially more expensive product. This results in financial loss due to underpayment and inaccurate order records. The flaw can be exploited repeatedly without limit, allowing significant abuse of the ecommerce system's checkout process.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement server-side validation ensuring that the stripeId used for payment corresponds exactly to the variantId of the product ordered, preventing mismatched pricing and order records.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Secur0
- Date Reserved
- 2026-10-22T14:46:31.556Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada2c6e4d27ba8daa61bfc3
Added to database: 10/22/2026, 15:31:58 UTC
Last enriched: 10/22/2026, 15:45:21 UTC
Last updated: 10/22/2026, 15:46:58 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.