Is CVE-2026-110607 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110607?

CVE-2026-110607 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-110607

Description

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.