CVE-2026-111277: NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with customerid 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.
Affected Software
Event History
Frequently Asked Questions
Which deployments and orders are exposed?
NivoCart versions through 2.5.1 are affected. The exposure applies to guest orders, which are stored with customer_id 0.
What does an attacker need to exploit the issue?
No authentication, privileges, or user interaction are required. An attacker only needs to supply an order_id to the account/order download action and can iterate order IDs to locate guest orders.
What information can be disclosed?
Retrieved guest-order invoices can disclose guest names, addresses, telephone numbers, email addresses, purchased items, and order totals.
How can I determine whether records may already be exposed?
Review access logs for unauthenticated requests to the account/order download action, especially requests with varying or sequential order_id values. Guest orders with customer_id 0 are the records targeted by this issue.