CVE-2026-111277
HIGH
CVSS 7.5
Published: 2026-10-15
Modified: 2026-10-16
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.
Quick Facts
| CVE ID | CVE-2026-111277 |
| CVSS Score | 7.5 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Published | 2026-10-15 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/nivocart/nivocart
- https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b…
- https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b…
- https://github.com/nivocart/nivocart/issues/26
- https://www.vulncheck.com/advisories/nivocart-through-2.5.1-…
- https://github.com/nivocart/nivocart/issues/26