---
id: CVE-2026-111278
title: NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
summary: >-
  NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows
  unauthenticated attackers to defeat form protection because the expected code
  is printed as plain text in the HTML. Attackers can fetch protected forms,
  extract t…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-804
vendor: nivocart
product: nivocart
affected:
  - nivocart <= 2.5.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:23.205Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111278'
references:
  - url: 'https://github.com/nivocart/nivocart/issues/27'
    label: 'GitHub Issue #27'
  - url: >-
      https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/information/contact.php#L144-L150
  - url: >-
      https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/view/theme/default/template/information/contact.tpl#L43
  - url: 'https://github.com/nivocart/nivocart'
  - url: >-
      https://www.vulncheck.com/advisories/nivocart-through-2.5.1-captcha-bypass-via-answer-disclosed-in-page-html
    label: >-
      VulnCheck Advisory: NivoCart through 2.5.1 CAPTCHA Bypass via Answer
      Disclosed in Page HTML
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.450Z'
---

## Overview

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.

## Affected

- `nivocart <= 2.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.