Craft Commerce's CartController activates its RateLimiter only when the POST or GET parameter 'number' is supplied. An unauthenticated attacker can submit couponCode values to the actionUpdateCart endpoint without including the 'number' parameter. This omission prevents the creation of the IP rate-limit identity, effectively bypassing rate limiting controls. As a result, attackers can perform unlimited automated coupon-code guessing and enumeration against the session-based cart. The vulnerability is identified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) and is fixed in versions 4.11.2 and 5.6.5.

An unauthenticated attacker can bypass rate limiting controls on coupon code submissions, enabling unlimited automated attempts to guess or enumerate coupon codes. This could lead to unauthorized discount application or other business logic abuse within the ecommerce platform. There is no indication of direct system compromise or data breach from this vulnerability alone.

Upgrade Craft Commerce to version 4.11.2 or later in the 4.x series, or to version 5.6.5 or later in the 5.x series, where the issue is fixed. No other mitigations are indicated by the vendor advisory.