CVE-2026-12204: ShopXO Authorization Bypass in Order & Payment Processing

Technical summary

CVE-2026-12204 is an authorization bypass vulnerability in ShopXO's Crontab.php scheduled task controller. The affected functions—OrderClose, OrderSuccess, PayLogOrderClose, and GoodsGiveIntegral—perform sensitive operations (order finalization, payment reconciliation, and loyalty point allocation) but lack proper access control enforcement. The absence of authentication or session validation (CWE-285: Improper Authorization) combined with insufficient privilege separation (CWE-639: Authorization Bypass Through User-Controlled Key) enables unauthenticated remote code execution of these administrative functions. The CVSS 3.1 score of 7.3 (HIGH) reflects the network-accessible nature, low attack complexity, and partial impact to confidentiality, integrity, and availability.

Business impact

An attacker exploiting this vulnerability can alter order statuses without payment, initiate refunds or chargebacks, award fraudulent loyalty credits, or corrupt transaction records. For merchants using ShopXO, this translates to revenue loss (orders marked complete without payment), inventory mismanagement, customer account manipulation, and potential regulatory exposure for payment card handling violations. The publicly disclosed status means threat actors are actively testing and deploying attacks, making exploitation likely if systems remain unpatched.

Affected systems

ShopXO installations running version 6.7.1 and earlier are vulnerable. The attack vector is the Crontab.php endpoint, typically exposed via the application's API or scheduled task interface. Any organization operating an unpatched ShopXO deployment—whether on-premise or cloud-hosted—is immediately at risk. Verify your installed version against your deployment records.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no special user interaction, and minimal complexity—an attacker simply calls the affected functions via HTTP request to the scheduled task endpoint. Public disclosure means proof-of-concept code is circulating, lowering the barrier for opportunistic attackers. No KEV listing is confirmed, but the public exploit availability and vendor non-response warrant immediate prioritization.

Remediation

Upgrade ShopXO to a patched version released after 6.7.1 that includes proper authorization checks on all scheduled task functions. If an upgrade is not immediately available, implement network-level access controls to restrict the Crontab.php endpoint to trusted internal or administrative IP ranges only, and monitor invocation logs for suspicious patterns. Verify with the vendor that the patched version fully validates authentication and session state before processing order or payment operations.

Patch guidance

Contact your ShopXO vendor or consult their official advisory for the specific patched version that addresses CVE-2026-12204. Apply the patch to all production and staging instances. After patching, verify that order closure, payment logging, and reward distribution functions now require proper authentication. Test the patch in a non-production environment first to ensure no regression in legitimate scheduled task execution.

Detection guidance

Monitor web server and application logs for HTTP requests to /app/api/controller/Crontab.php or related scheduled task endpoints that lack valid session tokens or authenticated user context. Flag any direct calls to OrderClose, OrderSuccess, PayLogOrderClose, or GoodsGiveIntegral functions from external IP addresses. Implement rate limiting on the Crontab endpoint to reduce the velocity of exploitation attempts. Review database logs for unexpected order status changes, payment transactions, or loyalty point allocations occurring outside normal business processes.

Why prioritize this

This vulnerability merits immediate remediation due to the combination of high CVSS score (7.3), public exploit availability, remote accessibility, and high business impact. The vulnerability directly endangers financial transactions and order integrity—core functions of an e-commerce platform. Vendor non-response increases uncertainty about patch timelines, making compensating controls and network segmentation critical interim measures.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects an attack that can be launched remotely over a network (AV:N), requires no special user privileges or interaction (PR:N, UI:N), and causes partial disclosure, alteration, or disruption of system functionality (C:L, I:L, A:L). The score does not account for public exploit availability or vendor non-responsiveness, both of which increase practical risk. Organizations should treat this as a 'critical' business issue despite the technical HIGH rating.

Frequently asked questions