External control of an assumed‑immutable web parameter in EC‑CUBE’s AmazonPay plugin permits an attacker to craft a redirect to an arbitrary website during the ordering process. The affected parameter is unintentionally mutable, allowing the attacker to manipulate the user’s navigation flow. This flaw carries the risk that the user is steered to a malicious domain and may inadvertently reveal account information, thereby facilitating credential theft. The weakness is classified as CWE‑472, reflecting the improper handling of web parameter immutability.

The vulnerability affects EC‑CUBE CO.,LTD.’s AmazonPay Plugin for the EC‑CUBE 4 series, specifically AmazonPay Plugin (4.0 series) and AmazonPay V2 Plugin across the 4.0/4.1, 4.2/4.3 series, including the Bundle Edition. All listed variants are considered impacted and should be reviewed for applied patches.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires the attacker to lure a user into the checkout flow of a site running the vulnerable plugin, manipulating the redirect parameter to point to a malicious site. Successful exploitation results in user credential compromise and potentially broader account takeover. The attack vector is user‑initiated, through a crafted URL or form submission during a transaction.