Ten responsibly disclosed vulnerabilities were fixed across three CubeCart releases, including one rated CVSS 9.0. Here is what was found, and why authenticated-only is less reassuring than it sounds.
UK and EU distance selling rules give customers a cooling off period. CubeCart 6.7.4 added a proper request workflow with states, automatic acknowledgements and an audit trail.
CubeCart 6.7.4 added a statutory cancellation workflow for UK and EU merchants, a proper command line cron runner, and gzip compression of order baskets.
One shared image component everywhere, image search across the file manager, per-option product images, and uploads that select themselves. Plus the protective htaccess worth checking after a migration.
CubeCart now records every admin action with actor, IP and a diff, logs outbound HTTP calls, and deduplicates error rows so the log is actually readable.
CubeCart email now sends asynchronously via cron, tracks opens, and generates plain text automatically. It also shipped with a bug that sent blank order confirmations, fixed in 6.7.2.
CubeCart 6.8.0 brings Atrium, a new default storefront skin, a stock audit log, verified reviews and confirmed sign-ups. What it changes and what to check.
Seven built-in reports with xlsx export, including the Search Terms report that tells you what shoppers looked for and did not find. Plus the pagination bug that made earlier exports unreliable.
CubeCart 6.7.0 added a full sales reporting suite, asynchronous email with open tracking, and an audit log. It also removed the in-app database backup tool and the cookie consent banner.
Six relevance improvements, a graceful fallback when the cluster is down, and a quiet failure mode where the indexer reports success but indexes almost nothing.