CVE-2026-111278: NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. The attacker only needs to retrieve a CAPTCHA-protected form, read the expected value from the page HTML, and submit that value with the form.
Which actions may be exposed to automated abuse?
The disclosed CAPTCHA value can allow automation of protected workflows, including spam submissions, registrations, reviews, and account deletion requests.
Is user interaction or valid account access required?
No. The issue is remotely exploitable without authentication or user interaction, as reflected by the AV:N, PR:N, and UI:N metrics.
How can I determine whether an installation is affected?
Inspect CAPTCHA-protected form HTML and determine whether the expected CAPTCHA code is exposed in a captcha_image value or other plain-text page content. NivoCart versions through 2.5.1 are identified as affected.