CVE-2026-12204Disclosure

LOWCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/controller/Crontab.php of the component Scheduled Task Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-285CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-15); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs134d
Disclosure
CVE-2026-12204 (ShopXO) is a high-severity business-logic flaw on Public cron. Impacting payments, inventory, order status, and loyalty points PoC available See full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-15/TIER_2_CVE-2026-12204.md #CyberSecurity #EcommerceSecurity #DPI #BusinessLogic #AccessControl
Post summary
The post announces a high‑severity business‑logic vulnerability in ShopXO’s public cron, notes that a PoC exists, and links to an in‑depth analysis, but it does not report active exploitation or a patch.
0000058
53 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-12204 Authorization Bypass in ShopXO Up to 6.7.1 Scheduled Task Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-12204
Post summary
The post announces an authorization bypass vulnerability affecting ShopXO versions up to 6.7.1, but provides no PoC, exploit code, patch, or evidence of active exploitation.
0000055
4.0K followersView on X

Explore more

Back to dashboard