NivoCart versions up to 2.5.1 contain a missing authorization check (CWE‑862) in the account/order/download action, allowing unauthenticated users to request guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals for all guest orders.

The affected vendor is NivoCart. Any installation of the NivoCart e‑commerce platform whose version is 2.5.1 or earlier and which exposes the account/order/download endpoint to public traffic is impacted. The vulnerability does not depend on any other components or services and is present in all affected versions regardless of configuration.

The CVSS score of 8.7 classifies this flaw as high severity. The EPSS score of 0.00364 (approximately 0.36%) indicates a very low likelihood of exploitation, and it is not listed in CISA KEV, suggesting no documented active exploitation. The likely attack vector is through normal HTTP requests to the download endpoint, which requires no authentication. Successful exploitation enables attackers to enumerate order IDs and harvest confidential customer data for every guest order, posing a privacy violation at the system‑wide level.