EverShop CVE-2026-72843 Flaw Allows Unauthenticated Account Takeover

A critical flaw in the EverShop software allows complete unauthenticated account takeover attacks. Tracked as CVE-2026-72843, this severe defect carries a CVSS score of 9.3. Attackers can exploit this EverShop account takeover issue to steal buyer profiles and change passwords without requiring prior access.

Why It Matters

This EverShop account takeover defect poses a massive risk to online merchants and shoppers. An eCommerce platform vulnerability of this magnitude directly threatens user privacy and financial data. Furthermore, malicious actors can lock legitimate buyers out of their profiles entirely. As a result, businesses could face significant reputational damage and lost sales. Currently, security researchers have not confirmed any active exploitation in the wild. Moreover, no public proof-of-concept exploit code exists yet.

How the Attack Works

The core issue resides within the customer update route of the application. Developers mistakenly declared this specific route with public access. Consequently, the admin authentication middleware bypasses caller verification checks entirely. In addition, no customer-session middleware exists to guard the vulnerable route.

The handler script simply extracts a customer UUID from the requested URL path. Next, it writes the provided email and password back into the database. It completely skips verifying if the caller actually owns that target record. Therefore, anyone possessing a valid UUID can alter the account details. Unfortunately, these UUIDs sometimes leak through order confirmation emails or shared administrative links.

Affected Versions and Mitigation

The flaw impacts EverShop installations running versions prior to the latest release. Exact installation counts remain unavailable at this time. Administrators must apply the security patch immediately to protect their systems. Specifically, users should update to EverShop version 2.2.1 to resolve the defect. This patched release changes the affected route access setting from public to private.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.