CVE-2026-116215 LOW

CVE-2026-116215: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Vendor Maccmspro
Product maccms10
Weakness CWE-362
Published October 26, 2026
Last update October 26, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

Key dates

02Disclosure timeline

October 26, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2021-24377 Autoptimize < 2.7.8 - Race Condition leading to RCE CVE-2026-32398 WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability CVE-2023-6109 YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation CVE-2025-13231 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition CVE-2025-59577 WordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition Vulnerability