A flaw in detronetdip’s E‑commerce 1.0.0 allows attackers to bypass authentication when they call the /Admin/assets/backend/seller/add_seller.php endpoint by manipulating the email parameter, creating seller accounts without verification. The vulnerability is an Authentication Bypass (CWE‑287) and Missing Authentication (CWE‑306) that can be triggered remotely with crafted HTTP requests, granting an attacker the ability to assume a seller role and potentially access sensitive data or perform other privileged actions within the application.

The affected product is detronetdip’s E‑commerce 1.0.0, specifically the add_seller.php file located under /Admin/assets/backend/seller/ which handles the creation of seller accounts via a backend endpoint.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, yet code to exercise the flaw is publicly available on GitHub. Attackers can exploit the remote access vector by sending crafted requests to the endpoint, potentially creating multiple unauthorized seller accounts and enabling further compromise or privilege escalation.