CVE-2026-111278

Deferred Deferred - Pending Action

NivoCart CAPTCHA Bypass Vulnerability

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111278

Affected Vendors & Products

Vendor	Product	Version / Range
nivocart	nivocart	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-804	The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

Attack-Flow Graph

Executive Summary

NivoCart through version 2.5.1 has a CAPTCHA bypass flaw where the CAPTCHA code is displayed as plain text in the HTML source. This allows unauthenticated attackers to extract the code by matching a pattern and use it to bypass form protections.

Detection Guidance

Check if NivoCart forms expose CAPTCHA codes in HTML source. Inspect form pages for plain text captcha_image values or patterns like 'captcha_image' in HTML responses. Use tools like curl or browser dev tools to fetch form pages and search for exposed codes.

Impact Analysis

Attackers can automate spam submissions, fake registrations, fake reviews, and unauthorized account deletion requests. This could lead to abuse of forms, increased server load, and potential data integrity issues.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized automated submissions that could violate data protection principles under GDPR or HIPAA, depending on the data processed. It undermines integrity and access controls.

Mitigation Strategies

Upgrade NivoCart to the latest version beyond 2.5.1. If upgrading is not possible, implement input validation to block automated submissions and review form security configurations to ensure CAPTCHA codes are not exposed in HTML.

Hi! I’m here to help you understand CVE-2026-111278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70