CVE-2026-111278 Details
Description
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
A CAPTCHA bypass vulnerability has been identified in NivoCart versions through 2.5.1. This vulnerability allows unauthenticated attackers to circumvent form protection because the CAPTCHA code is exposed as plain text in the HTML. Attackers can retrieve protected forms, extract the CAPTCHA value using a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
To address this vulnerability, the CAPTCHA code should be served as an image through a dedicated endpoint, rather than being sent as raw text. The recommended approach is to use the `Captcha::showImage()` method to display the CAPTCHA code as an image, while the template should render the CAPTCHA as an image element.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-804 | Guessable CAPTCHA | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NivoCart | <= 2.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |