The vulnerability is a cross‑site request forgery flaw in jCart for OpenCart 2.3.0.2 that allows attackers to modify user account information, such as credentials, passwords, and affiliate details, without authentication. Attackers can craft malicious HTML forms targeting the extension’s account‑change endpoints, so that when a victim visits an attacker‑controlled page the browser submits privileged state‑changing requests under the victim’s session. This flaw is a CWE‑352 and can result in compromised accounts and potential credential theft.

The affected product is the Joomla! extension jCart for OpenCart, version 2.3.0.2. Users who have installed this exact version of the extension are vulnerable.

The vulnerability has a CVSS score of 6.9, indicating medium severity, and the EPSS score is < 1%. It is not listed in the CISA KEV catalog. An attacker would need to convince a legitimate user to visit a malicious page in order to trigger the request, making the exploit a user‑interaction attack. The risk is moderate, with the potential for unauthorized account modifications but no direct code execution or denial of service uncovered.