OpenCart 3.0.36 contains a cross‑site request forgery (CSRF) vulnerability in the /account/edit endpoint that allows an unauthenticated user to modify a victim’s account details, including email addresses. Once the account information has been altered, the attacker can trigger the password reset function to gain unauthorized access to the compromised account. This flaw exposes the confidentiality and integrity of user accounts and can lead to full account takeover.

The vulnerability affects OpenCart installations running version 3.0.36 (and the build identified by the CPE as 3.0.3.6). All sites using this version of OpenCart are potentially compromised, regardless of custom extensions, unless a later patch has been applied.

The CVSS score of 6.9 classifies the flaw as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating there is no publicly known exploitation at the time of analysis. However, the attack requires only a malicious link to be visited by an authenticated user, making the exploitation path straightforward with no privileged access or technical barrier. The primary attack vector is a CSRF request, and compromised accounts can then be used to steal sensitive data or perform further malicious actions on the platform.