Loaded Commerce 6.6 introduces a client‑side template injection flaw that allows unauthenticated attackers to execute arbitrary code on the server by manipulating the search parameter. The vulnerability is a direct command injection style weakness (CWE‑78), enabling code execution with the permissions of the web application process, thereby compromising confidentiality, integrity, and availability of the affected system.

The flaw affects the Loaded Commerce product, specifically version 6.6. Users running this version are exposed to the risk and should verify their installation and consider upgrading.

The CVSS score of 6.9 indicates moderate severity. EPSS is below 1%, suggesting the likelihood of exploitation is low at present. The vulnerability is not catalogued in CISA's KEV list. Attack access is unauthenticated, relying on a client‑side input vector – the search field – to deliver malicious template payloads that are processed server‑side. No zero‑day exploitation evidence is present, but exploit code is available in public exploit databases.