Business Logic Vulnerability in OpenCart Affects Payments

CVE-2026-119558

What is CVE-2026-119558?

OpenCart versions up to 4.1.0.4 are susceptible to a business logic flaw that permits logged-in customers to exploit the system by placing unpaid full-price orders. By manipulating reward points, attackers can utilize the Free Checkout feature to process an order without any payment. The exploitation involves applying reward points and saving the checkout state, enabling them to submit a transaction with zero points, which allows the order confirmation handler to proceed without requiring payment. This vulnerability poses significant risks to ecommerce platforms using OpenCart, highlighting the need for thorough security measures.

References