Live › vulnerability › CVE-2026-119558
OpenCart through 4.1.0.4 lets a logged-in customer clear reward points after choosing Free Checkout, so the order advances without payment. An attacker gets full-price orders completed for free.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Stores running OpenCart 4.1.0.4 or earlier where customers can log in and use reward points at checkout. Stores that do not use reward points or that run a later release are likely not affected, but the sources do not confirm a fixed version.
No product ranges from the sources yet.
install/index.php against the affected range through 4.1.0.4No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-119558")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.