The vulnerability lies in the authentication middleware that processes the plugin safe mode toggle on the admin logout route before confirming user authentication. Because of this, an unauthenticated remote attacker can send a single request to switch the shop’s plugin safe mode on or off. Turning safe mode on deactivates all installed plugins, including essential payment and shipping integrations, effectively rendering the online store non‑functional. The impact is a shop‑wide denial of service that can be triggered automatically against many installations.

The affected product is JTL‑Software GmbH’s JTL‑Shop e‑commerce platform. The CVE notes that manual patches will be issued for older unsupported versions, specifically 5.4.x and 5.5.x. No additional version details are supplied, so the vulnerability may exist in those and potentially other recent releases until remedied.

The CVSS score is 8.7, indicating high severity, yet the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only one crafted HTTP request and can be automated across multiple sites. Based on the description, the likely attack vector is remote HTTP access to the admin logout endpoint; the attacker does not need any prior credentials. Given the modest severity and lack of exploitation data, organizations should treat this as a serious risk for affected installations, especially those still running unsupported versions.