Vulnerability in Opencart
CVE-2026-119558
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/con… (technical-description)
- github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/con… (technical-description)
- abraxaslabs.tech/research/opencart-reward-free-checkout (third-party-advisory)
- github.com/opencart/opencart (product)
- www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-c… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-119558?
- CVE-2026-119558 is a low-severity vulnerability in Opencart, classified under Improper Enforcement of Behavioral Workflow. CVSS score: 3.1/10. Published 2026-10-30.
- How severe is CVE-2026-119558?
- Low severity. CVSS v3 base score is 3.1 out of 10.