Backdoor found in Webgility
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08. Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line. | 10.0 | 2% | KEV PoC |
| massroughly 100,000-300,000 internet-facing storefronts |
Full article356 words · extracted from sansec.io · click to collapse
Update Nov 23rd: Webgility has released a patch and a public statement, urging all customers to upgrade to version 345.
Update Nov 30th: Webgility has discovered another security issue and urges all customers to upgrade to version 346.
The VC-funded Webgility software contains a backdoor for the purpose of remote upgrades. This mechanism allows anyone to upload and execute PHP code. The Webgility engineering team has denied the existence of the backdoor, even when confronted with a functional proof of concept and a demonstration video.
Because of the severity, Sansec recommends Webgility customers to restrict access to trusted IPs or temporarily remove the software until there is a fix.
The backdoor was discovered by Eric Seastrand as part of a PCI code audit. He reported the security flaw on Oct 16th to Webgility, together with an extensive explanation, sample code and a demo video. Then, he got this odd response:
Our engineers further reviewed your E-mail and we would like to inform you that, this file can't execute automatically or through a Web Browser [...] we request you kindly do not test or trial anything in Webgility module folder
Eric answered patiently and explained once again how the unauthorized update mechanism poses a serious security threat. Webgility thanked him for the suggestion and closed the ticket without further ado.
Additional attempts to explain the security implications were also unsuccessful.
Sansec has validated Eric's proof of concept exploit code on a live store. Given the ongoing efforts by attackers to find vulnerabilities in third-party ecommerce software, this vulnerability poses a significant risk to Webgility customers and could be exploited for card skimming attacks.
Until Webgility releases a patch, customers should consider restricting access or temporarily removing the software. The vulnerable file can be found here.
Thanks to Eric and the fine people at Hypernode for additional research.
Read more
- Critical backdoor found in MGT Varnish extension
- Persistent backdoors injected on Adobe Commerce via new CosmicSting attack
- StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
- Adobe patches critical Magento account takeover (APSB26-92)
- Amasty patches dozens of Magento extensions, 2 critical
Text extracted automatically; images, tables and formatting may be missing. Original: https://sansec.io/research/webgility-backdoor