CVE-2026-119558
lowOpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points af…
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://abraxaslabs.tech/research/opencart-reward-free-checkout disclosure@vulncheck.com
- https://github.com/opencart/opencart disclosure@vulncheck.com
- https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/contro... disclosure@vulncheck.com
- https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/contro... disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-chec... disclosure@vulncheck.com