CVE-2026-111277 — NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order inv…
Published: 2026-10-15 · CVSS: 8.7 · CVSS 4.0
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7