CVE-2026-111277: NivoCart Vulnerability Exposes Guest Order Data
Article Content
- •NivoCart 2.5.1 has a critical missing authorization vulnerability allowing data exposure.
- •Unauthenticated attackers can retrieve sensitive guest order information by iterating order IDs.
- •Publicly reachable online shops with guest checkout features are at the highest risk.
NivoCart version 2.5.1 has a serious missing authorization vulnerability in the download() method, allowing unauthenticated attackers to access guest order invoices by manipulating the order_id parameter. This flaw exposes sensitive customer information, including names, addresses, emails, and purchase details, for all guest orders stored with customer_id 0. Attackers can easily enumerate order IDs due to their sequential nature, leading to significant privacy and regulatory risks. Publicly accessible online shops that permit guest checkouts are particularly vulnerable. The CVE-2026-111277 was published on October 15, 2026, with a CVSS score of 8.7, indicating a high severity. Immediate action is recommended to mitigate potential exploitation, although current exploitation urgency remains uncertain.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-111277 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of NivoCart are affected?
What data can be accessed through this vulnerability?
What should I do if my shop uses NivoCart?
Continue Reading
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include… 
Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…