The vulnerability is a server‑side template injection (SSTI) that can be triggered by a normal customer during the "add address" step of a product order. By supplying crafted input, the attacker can cause the application to execute arbitrary code within the context of the Bagisto admin interface. This allows compromise of the server, data exfiltration, and further lateral movement. The weakness is identified as CWE‑1336, indicating that trusted template processing is incorrectly performed on untrusted input.

The affected product is Bagisto, an open source Laravel eCommerce platform developed by Webkul. Versions earlier than 2.3.10 are vulnerable. Version 2.3.10 includes a patch that mitigates the injection vector by sanitizing or restricting template rendering in the add address flow.

The CVSS score of 8.9 marks the issue as high severity, while the EPSS score of less than 1% suggests that active exploitation is unlikely at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be an unauthenticated or low‑privilege web user ordering a product, which enables injection of a malicious template payload that is executed on the server when rendered in an admin context.