CVE-2026-21447: 
PHP vulnerability analysis and mitigation

CVE-2026-21447 is an Insecure Direct Object Reference (IDOR) vulnerability in the customer order reorder functionality of Bagisto, an open-source Laravel-based eCommerce platform. Any authenticated customer can access and interact with another customer's order by manipulating the order ID parameter in the reorder route. All versions prior to 2.3.10 are affected. The vulnerability was published on January 2, 2026, with a patch released in version 2.3.10. It carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, Bagisto Advisory).

The root cause is improper access control (CWE-284) and authorization bypass through a user-controlled key (CWE-639). The vulnerable reorder method in packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php retrieves orders using only the supplied order ID ($this->orderRepository->findOrFail($id)) without verifying that the order belongs to the authenticated customer — unlike other order-related functions such as view, cancel, and printInvoice that do enforce ownership checks. The exposed route is Route::get('reorder/{id}', 'reorder'), accessible at /customer/account/orders/reorder/{id}. A proof-of-concept is included in the official advisory, demonstrating exploitation via simple HTTP GET requests with a manipulated order ID (Bagisto Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to enumerate and access other customers' order details, exposing sensitive purchase information such as product selections and order history. The attacker can also add items from a victim's order directly into their own shopping cart, enabling potential fraud and social engineering attacks. Availability is not impacted, but confidentiality is highly compromised and data integrity is partially affected through unauthorized cart manipulation (Bagisto Advisory, Github Advisory).

A proof-of-concept is publicly documented in the official GitHub Security Advisory, demonstrating exploitation using simple curl commands requiring only a valid customer account. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.014% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Bagisto Advisory).

1. Reconnaissance: Identify a target Bagisto storefront running a version prior to 2.3.10. Confirm the presence of the reorder route by browsing to /customer/account/orders/reorder/.
2. Account Registration: Register a legitimate customer account on the target Bagisto store to obtain authenticated session credentials.
3. Authenticate: Log in as the attacker using a POST request to the customer login endpoint:

   curl -c cookies.txt -X POST "http://target.xxx/customer/login" -d "email=attacker@evil.com&password=123qwe"

4. Enumerate Order IDs: Iterate over sequential integer order IDs (e.g., 1, 2, 3, ...) in the reorder route to identify valid orders belonging to other customers:

   curl -b cookies.txt "http://target.xxx/customer/account/orders/reorder/1"

5. Verify Cart Manipulation: Check the attacker's shopping cart to confirm that items from the victim's order have been added:

   curl -b cookies.txt "http://target.xxx/api/checkout/cart"

6. Exfiltrate Information: Review cart contents to discover what products the victim purchased, enabling targeted fraud or social engineering (Bagisto Advisory).

• Network: Repeated GET requests to /customer/account/orders/reorder/{id} with sequentially or randomly varying integer IDs from a single authenticated session, especially across IDs not associated with that customer's account.
• Logs: Web server or application logs showing a single customer session accessing multiple distinct order IDs via the reorder route in a short time window; HTTP 200 responses to reorder requests for orders not belonging to the requesting customer.
• Application: Unexpected items appearing in a customer's shopping cart that do not correspond to their own order history; cart contents matching products from other customers' orders (Bagisto Advisory).

Upgrade Bagisto to version 2.3.10 or later, which patches the vulnerability by adding a customer ownership check in the reorder method — querying orders by both customer_id (from the authenticated session) and the supplied id, and returning a 404 if no matching order is found. No official configuration-based workaround is available; upgrading is the only recommended remediation. Administrators should also audit access logs for signs of prior exploitation (Patch Commit, Github Advisory).

The vulnerability was reported by security researcher DenizParlak and disclosed responsibly through GitHub's security advisory process. The Bagisto maintainers (Webkul) responded promptly, publishing the advisory and patch on January 2, 2026. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking platforms (Bagisto Advisory).