CVE-2021-39864: Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-15 · updated 2026-06-17
Weakness: CWE-352

Description

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

Affected products

Adobe Commerce: through 2.3.7; 2.3.7-p1, 2.4.2, 2.4.2-p1, 2.4.2-p2, 2.4.3
Adobe Magento Open Source: through 2.3.7; 2.3.7-p1, 2.4.2, 2.4.2-p1, 2.4.2-p2, 2.4.3

References

Get alerted when CVE-2021-39864 or the next vulnerability affects your stack