Bagisto’s installer API routes remain accessible after the initial setup on versions prior to 2.3.10. The lack of authentication allows an attacker to create administrative accounts, alter configuration settings, and overwrite existing data, effectively granting full control over the e‑commerce site.

The vulnerable product is the Bagisto eCommerce platform from Webkul. Any deployment running version 2.3 on the 2.3 branch earlier than 2.3.10 is affected; version 2.3.10 and later contain the fix.

The flaw is scored CVSS 8.8 indicating high severity, but the EPSS score is below 1% and it is not listed in KEV, suggesting low current exploitation likelihood. Nevertheless, the absence of authentication means that any unauthenticated user who can reach the web application can exploit the /install/api/* routes. Successful exploitation results in full administrative access and the ability to modify or delete application data, posing a severe threat to confidentiality, integrity, and availability.