Is CVE-2026-112033 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112033 being exploited in the wild.

How severe is CVE-2026-112033?

Medium severity, with a CVSS score of 4.3, published 19 October 2026.

Which products and versions are affected?

Aircheng-Org iWebShop-5 up to 5.16.

How is CVE-2026-112033 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112033?

Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112033: aircheng-org iWebShop-5 CSRF in admin password change

CVE-2026-112033 · Severity: medium · CVSS 4.3 · Published 2026-10-19

iWebShop-5 is a PHP-based e-commerce platform that manages online storefronts. An attacker can trick an administrator into visiting a malicious page to forcibly change the admin password, resulting in complete account takeover and loss of administrative control over the store.

Technologies: Aircheng-Org iWebShop-5. Vendors: Aircheng-Org.

Quick answers

Is CVE-2026-112033 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112033 being exploited in the wild.
How severe is CVE-2026-112033?: Medium severity, with a CVSS score of 4.3, published 19 October 2026.
Which products and versions are affected?: Aircheng-Org iWebShop-5 up to 5.16.
Is there a fix for CVE-2026-112033?: No fixed version is recorded yet. Implement per-session CSRF tokens on all state-changing requests and validate them server-side. Additionally, configure session cookies with SameSite=Strict attribute and validate Origin/Referer headers on password change endpoints.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112033 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112033?: Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Implement per-session CSRF tokens on all state-changing requests and validate them server-side. Additionally, configure session cookies with SameSite=Strict attribute and validate Origin/Referer headers on password change endpoints.</anigation> </invoke>

Technical details

The admin_repwd_act function in controllers/system.php performs state-changing password updates using cookie-based authentication without CSRF token validation. An attacker can craft a cross-site request that, when visited by an authenticated administrator, submits a forged password change request and gains control of the admin account. The vulnerability requires user interaction (admin visiting an attacker page) but no special privileges.

Affected products

aircheng-org iWebShop-5 up to 5.16

Timeline

2026-09-30: disclosed: Issue reported on GitHub
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.