CVE-2026-111277

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order id. Attackers can iterate the order id parameter, which matches guest orders stored with customer id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.