Is CVE-2026-121628 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121628?

CVE-2026-121628 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-121628

Description

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.