SZB-6d22f3b385
EUVD lists OpenCart checkout logic flaw allowing unpaid orders (EUVD-2026-113823)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- OpenCart
- Product
- OpenCart
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a business logic vulnerability in OpenCart through 4.1.0.4, scored 2.3/10 under CVSS v3.1. According to the listing, logged-in customers can place full-price orders without paying by clearing reward points after selecting Free Checkout.
If you use OpenCart
Check whether the store runs OpenCart 4.1.0.4 or earlier
Upgrade OpenCart to a release that the vendor marks as fixed
Review recent zero-value orders for unpaid transactions
What the sources say 1
· Mastodon: “OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout.” Source