medium · CVSS v3 5.3 · CVSS v4 6.9
CVE-2026-111278
NivoCart versions up to 2.5.1 expose the CAPTCHA code in plain text, allowing attackers to bypass form protection without authentication. Th
Overview
NivoCart versions up to 2.5.1 expose the CAPTCHA code in plain text, allowing attackers to bypass form protection without authentication. This flaw enables automated spam, fake registrations, reviews, and account deletions. The vulnerability is publicly documented as CVE-2026-111278 with a medium severity score.
Description
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
Impact
The flaw compromises the integrity of user-facing forms, permitting unauthorized actions such as account creation, review posting, and account deletion. While confidentiality is not directly affected, the integrity of data and the availability of services can be degraded by excessive spam traffic. Website administrators and end users are the primary stakeholders impacted.
Remediation
Apply the official patch to upgrade NivoCart to version 2.5.2 or later. If an upgrade is not immediately possible, enforce server-side CAPTCHA validation and remove any CAPTCHA code from the HTML output. Additionally, implement rate limiting on form submissions and monitor for abnormal activity patterns.
Risk context
The CVSS v3 score of 5.3 and v4 score of 6.9 classify this as a medium risk, with no EPSS data available. Defenders should treat it as a moderate priority issue, balancing patch deployment against operational constraints.
Affected products
- NivoCart 2.5.1
Scores
- Severity
- medium
- CVSS v2
- 5
- CVSS v3
- 5.3
- CVSS v4
- 6.9
- EPSS
- —