CVE-2026-93949: Authentication Bypass Using an Alternate Path or Channel in Omegathemes Grocery Shopping Store

This vulnerability in Omegathemes Grocery Shopping Store (versions up to 1.3.3) enables an attacker with limited privileges to bypass authentication by exploiting the password recovery functionality through an alternate path or channel. The CVSS 3.1 score of 7.1 indicates it is remotely exploitable with low attack complexity and no user interaction required. The impact includes limited integrity loss and high availability impact, but no confidentiality loss is indicated.

An attacker can bypass authentication controls, potentially allowing unauthorized actions that affect the integrity and availability of the affected system. Confidentiality is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the password recovery functionality and monitor for suspicious activity related to authentication bypass attempts.