NivoCart up to version 2.5.1 fails to protect its CAPTCHA, because the expected answer is rendered as plain text within the form page. This disclosure lets any unauthenticated user read the correct challenge value, defeat the verification step, and submit the form without restriction. Affected actions include automated spam, new user registrations, product reviews, and account deletion requests. The weakness is an information exposure flaw (CWE-804).

The issue is present in NivoCart, a lightweight e‑commerce platform, on all releases up to and including 2.5.1. The vulnerable code lives in the contact form controller and template, as documented on the project's GitHub. No other vendor or product variants are listed; only the NivoCart application is affected.

The CVSS base score of 6.9 signals a moderate impact from a remote web request. The EPSS score of <1% indicates a very low likelihood that this weakness will be actively exploited, and the vulnerability is not listed in the CISA KEV catalog. Attackers could fetch the vulnerable form, read the exposed captcha answer from the page HTML, and submit requests to automate spam or account modifications. Because the flaw requires no authentication or elevated privileges, it remains a low‑risk but still valid issue for sites lacking a fix.