CVE-2026-54643Medium· 5.4▾ TwilightPoC availableCubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Exploit / PoC code exists
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54648Medium· 6.5CubeCart is an ecommerce software solution
CVE-2026-54646High· 7.2CubeCart is an ecommerce software solution
CVE-2026-54647High· 7.2CubeCart is an ecommerce software solution
CVE-2026-54644Medium· 6.1CubeCart is an ecommerce software solution
CVE-2026-54645Medium· 4.8CubeCart is an ecommerce software solution
CVE-2026-54642Medium· 5.3CubeCart is an ecommerce software solution