CVE-2021-47946: 
OpenCart vulnerability analysis and mitigation

CVE-2021-47946 is a Cross-Site Request Forgery (CSRF) vulnerability in OpenCart version 3.0.3.6 (also referenced as 3.0.36) affecting the /account/edit endpoint. The vulnerability allows unauthenticated attackers to modify victim account details — including email addresses — by tricking authenticated users into visiting a malicious page, after which the attacker can leverage password reset functionality to fully take over the compromised account. The CVE was published to the NVD on May 10, 2026, with a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-352 (Cross-Site Request Forgery), where the /account/edit endpoint in OpenCart 3.0.3.6 fails to sufficiently verify that requests were intentionally submitted by the authenticated user. Because no CSRF token or equivalent anti-forgery mechanism is enforced on this endpoint, an attacker can craft a malicious HTML page or form that silently submits a state-changing POST request to /account/edit on behalf of a logged-in victim. A public exploit is referenced on Exploit-DB (entry 49407), and a VulnCheck advisory provides additional technical context (GitHub Advisory, VulnCheck Advisory).

Successful exploitation allows an unauthenticated attacker to modify a victim's account details — most critically the registered email address — without any credentials. Once the email is changed, the attacker can trigger a password reset to the attacker-controlled address, resulting in full account takeover. The primary impact is to integrity (unauthorized data modification) and, indirectly, confidentiality (unauthorized access to the victim's account and any stored order history, personal data, or payment information) (GitHub Advisory, Feedly).

A public proof-of-concept exploit is listed on Exploit-DB (entry 49407), lowering the barrier for exploitation. However, as of the publication date, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.029–0.038% (12th percentile), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify OpenCart storefronts running version 3.0.3.6 using passive techniques (e.g., HTTP response headers, page source meta tags, or Shodan/Censys queries for OpenCart-specific paths).
2. Craft CSRF payload: Create a malicious HTML page containing a hidden auto-submitting form targeting the victim's OpenCart instance at https://<target>/index.php?route=account/edit, with form fields pre-populated to replace the victim's email address with an attacker-controlled one.
3. Deliver payload: Distribute the malicious page link to the target victim via phishing email, social media, or any other social engineering vector, ensuring the victim is currently authenticated to the OpenCart store.
4. Trigger account modification: When the authenticated victim visits the malicious page, the browser automatically submits the forged request, changing the account email to the attacker's address without the victim's knowledge.
5. Account takeover via password reset: The attacker initiates a password reset on the OpenCart store for the victim's account. The reset link is sent to the attacker-controlled email, allowing the attacker to set a new password and gain full access to the victim's account (GitHub Advisory, Exploit-DB).

• Logs: Unexpected POST requests to /index.php?route=account/edit originating from unusual referrer URLs (e.g., external or unknown domains) in the OpenCart web server access logs; account email change events in the OpenCart admin audit log for users who did not initiate the change.
• Application Events: Password reset requests immediately following an account email modification for the same user account, especially from a different IP address than the original session.
• Network: HTTP POST requests to the /account/edit endpoint with a Referer header pointing to an external or suspicious domain rather than the store's own origin.

The primary remediation is to update OpenCart to a patched version that implements CSRF token validation on the /account/edit endpoint; administrators should check the OpenCart download page for the latest release. As interim mitigations, operators should implement SameSite=Strict or SameSite=Lax cookie attributes on session cookies, add Content Security Policy (CSP) headers, and consider requiring re-authentication (e.g., current password confirmation) before allowing account email changes. Users should be advised not to click unknown links while authenticated to the store (GitHub Advisory, VulnCheck Advisory).