The vulnerability is a cross‑site request forgery flaw in the jCart for OpenCart extension that lets an attacker modify user account data—including credentials, passwords, and affiliate details—without any authentication. By sending a victim to a crafted HTML form that posts to the extension’s change‑account endpoints, the attacker forces the victim’s browser to submit privileged state‑changing requests with the victim’s session. This weakness is classified as CWE‑352 and can result in compromised accounts and potential credential theft.

The affected product is the Joomla! extension jCart for OpenCart, version 2.3.0.2. Users who have installed this exact version of the extension are vulnerable.

The vulnerability has a CVSS score of 6.9, indicating medium severity, and there is no EPSS data available. It is not listed in the CISA KEV catalog. An attacker would need to convince a legitimate user to visit a malicious page in order to trigger the request, making the exploit a user‑interaction attack. The risk is moderate, with the potential for unauthorized account modifications but no direct code execution or denial of service uncovered.