CVE-2026-9591

Cross-Site Request Forgery (CSRF) in SimplCommerce News Module

6.9 Medium

CVE-2026-9591 is a medium vulnerability (CVSS 6.9) in Simplcommerce, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. No source names a fixed version.

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to /api/news-items, due to missing anti-CSRF protection.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.20%Unchanged since Jun 18, 2026

What each source reports

CVE List Score used 6.9

Cross-Site Request Forgery (CSRF) in SimplCommerce News Module

Record: CVE-2026-9591
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-352
Updated: 2026-11-02

EUVDEUVD-2026-37710 6.9

Record: EUVD-2026-37710
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4q34-xwfg-pm6w 8.3

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit...

Record: GHSA-4q34-xwfg-pm6w
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-352
Updated: 2026-11-02

NVD 6.9

Record: CVE-2026-9591
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-352
Updated: 2026-11-02

OSV 6.9