Vulnerability Description
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://abraxaslabs.tech/research/opencart-reward-free-checkout
- https://github.com/opencart/opencart
- https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/cata
- https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/cata
- https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via
FAQ
What is CVE-2026-119558?
CVE-2026-119558 is a vulnerability with a CVSS score of 3.1 (LOW). OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers ca...
How severe is CVE-2026-119558?
CVE-2026-119558 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119558?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.