EUVD-2026-102469
GHSA-vg5v-fhjm-x73p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFetch protected form page
-
ExploitRegex-extract plaintext captcha_image value
-
ExecutionSubmit form with valid answer
-
ImpactAutomate spam/registrations/deletion requests
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication CAPTCHA/guessable mechanism
|
| Exploitation Conditions | No special configuration is required: any NivoCart deployment through 2.5.1 that relies on the built-in CAPTCHA on public forms (contact, registration, reviews, account-deletion requests) is affected by default, because the expected answer is emitted in the page HTML as the captcha_image value. Exploitation is remote and unauthenticated against default configurations of NivoCart. The practical limit is impact scope only - the flaw enables automated form abuse (spam, fake registrations/reviews, deletion requests) but yields no data disclosure, privilege gain, or code execution; sites that have disabled or replaced the native CAPTCHA, or front forms with an external CAPTCHA/WAF, are not exposed. |
| Impact | This is a genuinely medium-severity, low-priority issue despite the CWE and bypass framing. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects remote, unauthenticated, low-complexity access, but the only impact is VI:L (integrity-low) with VC:N/VA:N - meaning no confidentiality or availability consequences and no code execution. The vulnerability merely allows automation of form submissions (spam, bulk registrations, fake reviews, account-deletion requests) that a CAPTCHA is meant to throttle; it does not grant data access or system compromise. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit is referenced, so there is no evidence of active exploitation. The 6.9 score is driven by the easy remote reach rather than by impact. Note the tag 'Authentication Bypass' conflicts with the actual nature of the flaw (a CAPTCHA/form-protection bypass per CWE-804, not an authentication bypass) - do not treat this as an auth-bypass path. Overall: a real but abuse/nuisance-class weakness, appropriate to patch on a normal cycle, not an emergency. |
| Exploit ScenarioDerived | An attacker's script fetches a NivoCart contact, registration, or review form and parses the HTML, where the expected CAPTCHA answer is rendered in plain text as the captcha_image value. The script extracts that value with a simple regex and submits it with the form, allowing fully automated, high-volume spam, fake account creation, bogus reviews, or mass account-deletion requests. No public proof-of-concept is referenced, but the technique is trivial and fully described in the VulnCheck advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
NivoCart through 2.5.1 emits the expected CAPTCHA answer directly into the HTML of protected public forms, so unauthenticated remote attackers can simply fetch the page, scrape the captcha_image value with a pattern match, and replay it to automate spam, fake registrations, bogus reviews, and account-deletion requests. Severity is moderate rather than critical: the independent assessment rates it CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only, no confidentiality or availability impact), consistent with the published CVSS 4.0 base score of 6.9, because the flaw yields no data disclosure, privilege gain, or code execution. No public exploit code, no CISA KEV listing, and no evidence of active exploitation were identified at time of analysis, and the real-world damage is bounded by the target's own handling of form submissions (e.g., mandatory email confirmation, review moderation).
RemediationAI
No vendor-released patched version is identified in the available data; the fix path is to track https://github.com/nivocart/nivocart/issues/27 and upgrade to the first NivoCart release published after 2.5.1 that stops emitting the answer client-side, then verify that contact.tpl no longer renders a captcha_image value expected to match server-side session state. Until such a release is confirmed, the most direct mitigation is to stop printing the expected code: either remove the captcha_image assignment from the default theme template so the answer stays in the session and is compared server-side on POST (trade-off: requires a small template/controller edit that must be re-applied after each upgrade), or disable the native CAPTCHA entirely and front the contact, registration, review, and account-deletion endpoints with an external CAPTCHA service or WAF bot-management rule (trade-off: added latency, third-party dependency, and possible user friction, but it removes the bypass entirely since the answer never reaches the client). Where the native challenge cannot be replaced, add server-side rate limiting and anomaly detection on those form endpoints, put new registrations behind mandatory email confirmation and reviews behind a moderation queue, and require out-of-band confirmation (email link or re-authentication) for account-deletion requests - each of these reduces the payoff of automated submissions but does not close the underlying disclosure, so treat them as compensating controls only. Sites that have already disabled or replaced the native CAPTCHA, or that place an external CAPTCHA/WAF in front of all public forms, are not exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-804 (Guessable CAPTCHA): instead of keeping the expected verification answer server-side in the session and comparing only a hash on submission, NivoCart builds the CAPTCHA in the contact controller (upload/catalog/controller/information/contact.php, lines 144-150 per the referenced commit 5bc2c3f) and passes the expected code into the view, where contact.tpl line 43 renders it as the captcha_image value inside the HTML response. Any client - a browser, curl, or an automation framework - therefore receives both the challenge and its answer in the same HTTP response, making the challenge trivially solvable without OCR, image analysis, or any authentication. The affected component is the NivoCart PHP e-commerce cart (an OpenCart-derived codebase) identified by CPE cpe:2.3:a:nivocart:nivocart:*:*:*:*:*:*:*:* for versions through 2.5.1; the same template/controller pattern governs the other CAPTCHA-protected endpoints (registration, reviews, account-deletion requests) cited in the description and the VulnCheck advisory. Because the CVSS 4.0 vector carries PR:N/UI:N, exploitation is remote and unauthenticated against default configurations; AT:N confirms no attack prerequisites beyond reaching a public form.
Know when Nivocart gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity form access (AV:N/AC:L/PR:N/UI:N); only integrity is lightly affected by automated submissions (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authenticated back-office users of NivoCart (through 2.4.0) holding only view-only privileges can upload and execute arb
Administrative account takeover in NivoCart through 2.4.0 is possible because the forgotten.php password-reset flow deri
NivoCart through 2.5.1 allows unauthenticated attackers to retrieve guest order invoices via the account/order download(
Unauthenticated attackers can disable self-service password recovery in NivoCart through 2.4.0 by sending a GET request
Exploit-DB