Phoca Cart EUVD-2026-92450

No special conditions - remote unauthenticated exploitation against default configurations of the Phoca Cart extension for Joomla (versions 5.0.0 through 6.1.8). The only functional prerequisite is that the target store sells digital/downloadable goods served through the order-file download endpoint, and that valid order records exist to enumerate via sequential id values. The sole limiting factor is that the attacker must supply non-empty d and o parameters (any arbitrary value satisfies the broken check) and guess or iterate numeric order IDs; no authentication, no user interaction, and no non-default setting is required.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity attack requiring no privileges and no user interaction, which matches the description precisely: a guest with no account supplies arbitrary non-empty d/o parameters and enumerates sequential id values. The impact is correctly scoped as confidentiality-only (VC:H, VI:N/VA:N) because the flaw exposes other customers' digital goods without allowing modification or disruption. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so exploitation probability cannot be quantified from signals - however, the trivial exploit mechanics (IDOR with sequential IDs and token checks that only test non-emptiness) mean a working exploit is easy to construct even absent public code. The single reference is only the vendor homepage (https://www.phoca.cz/), not a dedicated advisory, so the fixed version and precise remediation are not confirmed from the provided data and should be verified with Phoca directly.

An unauthenticated attacker requests the Phoca Cart order-file download endpoint, passing any non-empty values for the d (download token) and o (order token) parameters and a guessed numeric id. Because the endpoint only checks that the tokens are non-empty and never compares them to the stored download_token/order_token, the attacker iterates sequential id values to download arbitrary customers' purchased digital products. No public exploit identified at time of analysis, but the flaw is trivially scriptable.