OpenCart up through version 4.1.0.4 contains a business‑logic flaw that allows a logged‑in customer to place an order for the full value of the cart and then clear all reward points before submitting the order, thereby reaching the Free Checkout status without actually making a payment. The flaw resides in the reward point and free checkout controllers; the attacker can apply points, select Free Checkout, then submit zero points via reward.save, causing the order total to be accepted as zero. Because the system accepts a zero‑amount payment when free checkout is chosen, the attacker can effectively bypass the payment gateway and start a fraudulent purchase. The weakness corresponds to CWE‑841: “Access Control Failure.”

All OpenCart installations running version 4.1.0.4 or earlier are affected. The vulnerability is found in the reward.php and free_checkout.php controller code that governs order confirmation and reward point adjustments. Any store that enables the free checkout option for customers who have available reward points is at risk. Upgrading to 4.1.0.5 or newer removes the flaw.

The CVSS base score of 2.3 indicates a low technical impact, but the attack requires an authenticated customer session and leverages existing business logic, which means the threat is mainly to the store’s own customer base with potential financial loss. The CVE data does not provide an EPSS metric, so the exploitation probability is not quantified. The vulnerability is not listed in the CISA KEV catalog and there are no confirmed exploitation reports publicly known. The likely attack vector is an authenticated customer with reward points, who can exploit the free checkout processing path to avoid payment.