Product
NivoCart through 2.5.1 contains a missing authorization vulnerability in the account/order module that allows unauthenticated attackers to exfiltrate guest order invoices by iterating order identifiers.