NivoCart: Missing authorization in order download exposes guest invoices

Summary

NivoCart through version 2.5.1 has a missing authorization check in the download() action of account/order. An unauthenticated remote attacker can request guest order invoices by iterating the order_id parameter. The exposed data includes names, addresses, telephone numbers, email addresses, purchased items and totals of guest orders.

Affected

• NivoCart through 2.5.1 (per NVD and the CVE record; the affected range is treated as 2.5.1 and earlier until the vendor clarifies)
• Only guest orders (customer_id 0) are described as exposed

Fixed in

Unknown.

• No vendor statement or confirmed fixed version was found.
• v2.5.3 (published 29 October 2026) does not list this flaw in its changes; whether it fixes the issue is unverified.

Workaround

• Restrict access to the account order download route at the web server or WAF so unauthenticated requests are blocked, and verify that normal customer flows still work.
• Check whether the download route is reachable from the internet.
• No vendor-published workaround found.

Exploitation

• No confirmed in-the-wild exploitation found; the CVE is not listed in KEV.
• Public proof of concept reported; CISA SSVC lists exploitation as poc and automatable as yes.

Our recommendation

• Confirm whether NivoCart is installed and which version is running.
• Restrict or block the download route until the vendor confirms a fix.
• Review web server access logs for many sequential order_id requests to that route.
• Assess whether guest customer data was exposed and whether a data protection breach assessment (revFADP) is required.
• Apply the vendor update once a fix is published and confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• NVD / CVE record via VulnCheck advisory www.vulncheck.com
• NivoCart GitHub issue 26 github.com
• NivoCart order controller (vulnerable code) github.com
• NivoCart GitHub repository github.com
• NivoCart release v2.5.3 github.com
• OpenCVE CVE-2026-111277 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:25.