---
id: CVE-2026-111278
title: >-
  NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows
  unauthenticated attackers to defeat form protection because the expected code
  is printed as plain text in the HTML
summary: >-
  NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows
  unauthenticated attackers to defeat form protection because the expected code
  is printed as plain text in the HTML. Attackers can fetch protected forms,
  extract t…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-804
vendor: nivocart
product: nivocart
affected:
  - nivocart <= 2.5.1
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:17:37.350'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111278'
references:
  - url: 'https://github.com/nivocart/nivocart'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/information/contact.php#L144-L150
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/view/theme/default/template/information/contact.tpl#L43
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nivocart/nivocart/issues/27'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nivocart-through-2.5.1-captcha-bypass-via-answer-disclosed-in-page-html
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00321
epssPercentile: 0.24964
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T16:46:53.427608Z'
ingestedAt: '2026-10-15T22:48:25.450Z'
---

## Overview

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.