CVE-2026-41874 describes a CWE-256 vulnerability in OpenSolution Quick.Cart where plaintext admin credentials are hard-coded and stored in a configuration file. An attacker with access to the server file system can extract these credentials, which may enable privilege escalation. The vendor has not provided a patch or official remediation and considers the risk of exploitation very low. The vulnerability was confirmed in version 6.7, but all versions are presumed affected.

If an attacker gains access to the server file system, they can retrieve plaintext admin credentials, potentially escalating privileges within the application. This could compromise administrative control over Quick.Cart. However, the vendor rates the likelihood of exploitation as very low, indicating limited practical risk under normal conditions.

The vendor has determined that a fix is not necessary due to the very low likelihood of exploitation. No official patch or remediation is available. Users should restrict file system access to trusted parties only to mitigate risk.