High · published December 17, 2025
⚡ A sneaky CSRF vulnerability opens the door in nopCommerce 4.90.0, allowing attackers to impersonate users via the Schedule Tasks functionality! 🔥 Think of it like a restaurant where a customer can place an order under another customer’s name without them knowing—nobody checks who is really at the table! An attacker could exploit this vulnerability to execute unauthorized actions on behalf of logged-in users, potentially altering schedules or tasks without their consent. This could lead to a cascade of unwanted changes, affecting the integrity of your e-commerce operations!
Think of it like a restaurant where a customer can place an order under another customer’s name without them knowing—nobody checks who is really at the table! This vulnerability allows unauthorized requests to be made by an authenticated user, as the application does not properly validate the source of the requests in its Schedule Tasks functionality.
An attacker could exploit this vulnerability to execute unauthorized actions on behalf of logged-in users, potentially altering schedules or tasks without their consent. This could lead to a cascade of unwanted changes, affecting the integrity of your e-commerce operations! To safeguard your system, immediately update nopCommerce to version 4.90.1 or later where this vulnerability is patched. Additionally, consider implementing CSRF tokens for your forms to further bolster security! You can tackle this! Apply the fix and keep your platform secure—your security hero status is activated! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| nopcommerce/nopcommerce | all versions | — |