ZeusCart 4.0 includes a cross‑site request forgery flaw that lets an attacker, by luring an authenticated administrator to a malicious site, submit crafted requests to the regstatus endpoint and permanently deactivate customer accounts. This loss of account access disrupts customer service and can damage the merchant’s reputation. The weakness is a CWE‑352 CSRF vulnerability.

The vulnerability affects the ZeusCart e‑commerce platform, specifically version 4.0. Administrators who log into the backend are the primary exposed users. No other versions or products are listed as affected.

The CVSS score of 6.9 indicates a moderate‑to‑high risk level. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no widely known exploits as of now. The likely attack vector requires the victim admin to load a malicious page while authenticated, a scenario that only occurs when administrators use shared or unsecured browsers.