CVE-2026-119558
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
Risk Assessment
Customers can obtain goods without payment, leading to financial losses and abuse of the ordering process.
Recommendation
Update OpenCart to a version later than 4.1.0.4 once a fix is available, and monitor for unusual orders.
Other vulnerabilities in OpenCart
See all- CVE-2026-18412Critical
The OpenCart v4.2.0.0 extension installer does not validate that extracted paths stay within the intended directory. An attacker can craft a malicious extension with path traversal sequences to write files, such as a PHP web shell, into the webroot.
- CVE-2021-47923Critical
OpenCart version 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.
- CVE-2026-84438Low
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-84437Low
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2021-47953Medium
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.
- CVE-2021-47946Medium
OpenCart 3.0.3.6 has a cross-site request forgery vulnerability in the /account/edit endpoint, allowing unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can change email addresses and use password reset to take over accounts.
- CVE-2025-15116Low
A security flaw was discovered in OpenCart up to version 4.1.0.3 in the Single-Use Coupon Handler component. Manipulation results in a race condition. The attack may be initiated remotely but is difficult to exploit. The vendor was contacted but did not respond.
Original NVD description (English source)
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS