CVE Alert: CVE-2026-111277 – nivocart

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

**Risk verdict:** Treat this as a serious, internet-facing data exposure; exploitation urgency is uncertain because KEV, SSVC and exploitation-likelihood data were not provided.

**Why this matters:** An attacker may obtain personal and purchase information for guest customers, creating privacy, regulatory and reputational consequences. The data could also support targeted phishing, impersonation or order-related fraud.

**Most likely attack path:** An unauthenticated attacker sends requests to the invoice-download function and varies the order identifier, requiring no user action or special conditions. The impact appears confined to the affected application, with no direct system-level pivot indicated, though stolen customer data could enable follow-on attacks.

**Who is most exposed:** Publicly reachable online shops that allow guest checkout are the clearest concern, especially those retaining guest order records and exposing the affected download route.

Find unauthenticated requests to the invoice-download route.

Alert on rapid or sequential changes to order identifiers.

Review response sizes and repeated successful invoice downloads.

Correlate access with unusual source addresses or scraping patterns.

Mitigation and prioritisation:

Confirm vendor remediation and apply a corrected release promptly; validate the route after deployment.

Until then, restrict or disable guest invoice downloads where operationally feasible.

Enforce server-side authorisation and ownership checks; do not rely on hard-to-guess identifiers.

Review logs for access and assess whether privacy notification obligations apply.

Reassess urgency when KEV, SSVC, PoC or EPSS data becomes available.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.