Researchers have disclosed a critical vulnerability in BlockStrap, a component used with Magento and Adobe Commerce. Tracked as CVE-2026-103849, the flaw carries a maximum severity rating and could allow attackers to execute arbitrary PHP code on affected store servers.
The issue is particularly concerning because the researchers warn that exploitation may be imminent. If successful, an attacker could gain significant control over a server, potentially leading to data theft, site defacement, or further compromise of the underlying infrastructure.
As of the report, no evidence of active exploitation has been mentioned, but the risk is considered high. Store operators using BlockStrap with Magento or Adobe Commerce should treat this as urgent and monitor vendor guidance for patches or mitigations.