Quick.Cart stores hard‑coded administrative credentials in a plain‑text configuration file. This flaw allows an attacker who can read the server’s file system to obtain those credentials, resulting in credential disclosure and potentially granting privileged access to the application. The weakness is a classic hard‑coded credential issue (CWE‑256), providing a straightforward path to elevate privileges within the cart system.

OpenSolution’s Quick.Cart shopping‑cart software, including version 6.7 (the only version specifically tested) and all other releases, is affected by this vulnerability.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of less than 1 % and the vendor’s assessment of a very low exploitation likelihood suggest that the risk to most deployments is low unless an actor already has local or remote file‑system access. Exploitation requires the attacker to obtain read permission on the configuration file, a condition typically met only after the system has been compromised or misconfigured. Consequently, the primary attack vector is local or post‑compromise file‑system access rather than remote exploitation.