NivoCart CVE-2026-111277

Exploitation requires that the NivoCart instance has guest checkout in use so that guest orders exist (stored with customer_id 0) and that the account/order download() invoice action is reachable - which per the description it is, with no authorization enforced. No authentication, session, or user interaction is needed (CVSS PR:N/UI:N), and default configurations are affected. The practical limiting factors are: only guest orders (not registered-customer orders) are exposed, and the attacker must hit valid/existing order_id values, so a store with few or no guest orders yields little, and successful enumeration depends on the id space actually containing stored guest invoices.

This is a genuine, easily-actionable information-disclosure flaw rather than a high-CVSS-but-theoretical issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, and the impact is confidentiality-only (VC:H, VI:N, VA:N) - consistent with the CWE-862 missing-authorization classification and the description of IDOR-style order_id enumeration. The 8.7 HIGH score is well-supported by the vector. However, several real-risk-dampening signals are MISSING from the input and must be stated explicitly: no EPSS score was provided, there is NO CISA KEV listing, and no public proof-of-concept exploit is indicated. The flaw was reported by VulnCheck (a credible source) with a vendor/advisory reference, so the technical finding is trustworthy, but there is no evidence of active exploitation. The practical risk is therefore moderated primarily by the low real-world deployment footprint of NivoCart, not by exploitation difficulty - the technique itself is trivial (incrementing an integer). Net: credible, trivially-exploitable PII disclosure, but likely low aggregate risk due to the product's niche footprint and absence of confirmed exploitation.

An unauthenticated attacker discovers a NivoCart storefront and requests the account/order download() invoice endpoint while incrementing the order_id parameter, which maps to guest orders stored under customer_id 0. Because no authorization check is enforced, each valid id returns a guest invoice, so the attacker scripts sequential enumeration to harvest customer names, addresses, phone numbers, emails, purchased items, and order totals. No public exploit code is identified at time of analysis, but the attack requires only trivial HTTP requests and integer iteration.