I was getting hit with cart order spam. Frank, my web tech, looked into it and found this after running it through Claude.

Found the bug: inccart.php:4247 saves checkout orders even when validation fails, which is how bots posting blank fields slip past domain checks.

I Google-searched and found that hackers are using Claude Code to hack; it might be a good idea to use Claude to find the exploits first.

Hi Steven
That an order is created isn't hacking and it's what happens every time someone purchases something in your shop. And we are using Claude more and more for security and other issues as I'm sure most are.
But I think I know what this is referring to and it is already addressed in the updater if you would like to update.

Vince

Click Here for Shopping Cart Software
Click Here to sign up for our newsletter
Click Here for the latest updater

Ok forgive me for not being more descriptive.

The orders came in with NO info other than the city and state. And was this what the updater fixed?

Id like to add,

It wasn't just 1 order. There were a couple dozen this morning and used generic random info. The only comon denoninator was the random @example emails it was using.

Once we blocked the example.com domain email address, it then started order attempts with blank info.

Also, s the fix in 7.9.6 or is the 8.0.1 ?

Hi Steven
The fix is in both versions of the updater.

Vince

Click Here for Shopping Cart Software
Click Here to sign up for our newsletter
Click Here for the latest updater

Thanks!!