OpenCart CVE-2025-15116

The Single-Use Coupon Handler component must be active and processing coupon redemptions. Exploitation requires the attacker to send multiple concurrent requests targeting the same coupon code within the narrow timing window between coupon validation and state update. No authentication is required. The race condition is more likely to succeed under high-latency or high-load conditions where timing windows are wider, and less reliable on local or low-latency networks. The vulnerability does not manifest if the deployment uses database-level locking or optimistic concurrency control on coupon state updates.

Despite the CVSS 2.9 score and high attack complexity (AC:H), real-world risk is minimal. EPSS scoring at 0.06% (19th percentile) indicates very low exploitation probability across the threat landscape, consistent with the difficulty rating in the description. The attack vector is network-accessible (AV:N) and requires no authentication (PR:N), but the high complexity and limited integrity impact (VI:L with no confidentiality or availability impact) restrict practical exploitation. The existence of public exploit code (POC=P) does not translate to active exploitation pressure, as the race condition requires precise timing and coordination. CVSS indicates this affects information disclosure of coupon state rather than financial fraud or system compromise. The vendor's lack of response to early disclosure suggests this is not treated as a high-priority issue upstream. For most OpenCart deployments, this poses low exploitability risk unless the attacker has specific knowledge of the coupon system architecture and tight network conditions to execute the race condition reliably.

An attacker identifies an active single-use coupon code offering significant discount and submits multiple redemption requests in rapid succession from different sessions or threads. Due to the race condition in the coupon validation logic, the first request validates the coupon as available while a second request is processed before the coupon is marked as consumed, allowing both redemptions to succeed. This could result in multiple applications of a single-use discount or unauthorized visibility of coupon validity state.