---
id: "CVE-2026-119558"
kind: "vulnerability"
aliases: ["CVE-2026-119558"]
title: "OpenCart: logged-in customers can place unpaid orders via reward points"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ecommerce", "opencart", "php", "runtime"]
not_affected_if: ["guest-checkout-only", "no-reward-points"]
published_at: "2026-10-30T12:16:43+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:34:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119558", "first_seen_at": "2026-10-30T12:30:26+00:00"}]
---

# OpenCart: logged-in customers can place unpaid orders via reward points

OpenCart through 4.1.0.4 lets a logged-in customer clear reward points after choosing Free Checkout, so the order advances without payment. An attacker gets full-price orders completed for free.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenCart version in the admin dashboard footer or `install/index.php` against the affected range through `4.1.0.4`
- Review whether the checkout flow in your store accepts reward points and Free Checkout together

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119558

## From the sources

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_