OpenCart 3.0.3.7 contains a cross‑site request forgery flaw that allows an attacker to change the password of an authenticated user by sending a crafted POST request to the /account/password endpoint. The vulnerability exploits the absence of a CSRF token on the password change form, enabling attackers to trick users into submitting hidden forms that set new values for the 'password' and 'confirm' fields. If successful, the attacker can take control of the victim account, compromising confidentiality and integrity of the site data.

The flaw is limited to OpenCart version 3.0.3.7. No other versions or vendors are listed as affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. However, the attack requires the victim to be logged in and to unknowingly submit a malicious form, a scenario that is feasible in many web contexts. Depending on the user base, the risk of account takeover remains significant for sites that cannot immediately patch.