---
id: CVE-2026-119558
title: OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points
summary: >-
  OpenCart through 4.1.0.4 contains a business logic vulnerability that allows
  logged-in customers to place unpaid full-price orders by clearing reward
  points after selecting Free Checkout. Attackers can apply points, save Free
  Checkout, t…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-841
vendor: OpenCart
product: OpenCart
affected:
  - OpenCart <= 4.1.0.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:18:51.525209Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:19:00.798Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119558'
references:
  - url: >-
      https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/checkout/reward.php#L89-L94
  - url: >-
      https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/payment/free_checkout.php#L47-L55
  - url: 'https://abraxaslabs.tech/research/opencart-reward-free-checkout'
  - url: 'https://github.com/opencart/opencart'
  - url: >-
      https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-checkout-reward-points
    label: >-
      VulnCheck Advisory: OpenCart through 4.1.0.4 Payment Bypass via Free
      Checkout Reward Points
tags:
  - cve.org
epss: 0.00201
epssPercentile: 0.10113
ingestedAt: '2026-11-03T11:43:15.773Z'
---

## Overview

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.

## Affected

- `OpenCart <= 4.1.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.