Smartshop 1 contains a CSRF vulnerability that lets attackers modify user profiles by tricking authenticated users into submitting forged requests. When an admin visits a specially crafted HTML page, the hidden form targets editprofile.php with altered email and password fields, and the request is sent automatically. This flaw allows unauthorized users to change account information without knowledge of credentials, potentially escalating privileges or enabling phishing attacks. The weakness is classified as CWE-352, indicating a lack of anti‑CSRF mechanisms.

The affected product is the Behance Smartshop e‑commerce website, version 1. No specific patch or version information is provided in the CVE data. All installations of Smartshop 1 that expose editprofile.php to authenticated admins are susceptible.

The CVSS base score for this vulnerability is 5.3, indicating moderate overall risk. No EPSS score is publicly available and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be a classic CSRF scenario requiring an authenticated admin to visit a malicious page; thus it does not require network access or local privileges. Exploitation is straightforward – simply lure an admin to a crafted page – but successful attacks depend on the presence of a valid administrator session.