CVE-2025-47272 PhoenixCart Vulnerable to Account Deletion Without Password Confirmation
Attackers with session access can delete user accounts without password confirmation, risking data loss and account takeover in PhoenixCart.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-47272?
CVE-2025-47272 is a medium-severity missing authorization vulnerability in CE-PhoenixCart PhoenixCart, published on 2 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring password re-authentication. An attacker with temporary access to an authenticated session (e.g., on a shared/public machine) could permanently delete the user’s account without knowledge of the password. This bypass of re-authentication puts users at risk of account loss and data disruption. Version 1.1.0.3 contains a patch for the issue.
Weakness: CWE-306
Which versions are affected by CVE-2025-47272?
How do I fix CVE-2025-47272?
No fix has been published for CVE-2025-47272 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-47272 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47272 exists.
Sources
Also known as GHSA-62qj-pvwm-h8cv.