CVE-2026-111278: medium-severity vulnerability in nivocart
NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9
exploitation probability
—
observed exploitation
nono source reports it
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
nivocart · nivocartRelated CVEs — nivocart
In the same product, most dangerous first.
CVE-2026-94104HIGHNivoCart through 2.4.0 Arbitrary File Upload RCE via filemanagerEPSS 0.7%CVE-2026-94107CRITICALNivoCart through 2.4.0 Predictable Administrator Password Reset TokenEPSS 0.6%CVE-2026-94105MEDIUMNivoCart through 2.4.0 Destructive Configuration Write via the Password Reset ControllerEPSS 0.4%CVE-2026-111277HIGHNivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/downloadEPSS —
References
https://github.com/nivocart/nivocarthttps://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/information/contact.php#L144-L150https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/view/theme/default/template/information/contact.tpl#L43https://github.com/nivocart/nivocart/issues/27https://www.vulncheck.com/advisories/nivocart-through-2.5.1-captcha-bypass-via-answer-disclosed-in-page-html