Is CVE-2026-86670 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86670 being exploited in the wild.

How severe is CVE-2026-86670?

Low severity, with a CVSS score of 3.7, published 8 September 2026.

Which products and versions are affected?

Aircheng-Org iWebShop-5 up to 5.15.

Is there a fix for CVE-2026-86670?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86670 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86670?

Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86670: aircheng-org iWebShop-5 weak password hashing

CVE-2026-86670 · Severity: low · CVSS 3.7 · Published 2026-09-08

iWebShop-5 is an open-source e-commerce platform that stores user, admin, and seller passwords using unsalted MD5 hashing instead of modern algorithms. If a database is compromised through backup exposure, SQL injection, or misconfigured access, attackers can rapidly crack password hashes using online rainbow tables or GPU-accelerated tools, gaining immediate access to administrative and customer accounts. This substantially increases the damage from any data breach.

Technologies: Aircheng-Org iWebShop-5. Vendors: Aircheng-Org.

Quick answers

Is CVE-2026-86670 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86670 being exploited in the wild.
How severe is CVE-2026-86670?: Low severity, with a CVSS score of 3.7, published 8 September 2026.
Which products and versions are affected?: Aircheng-Org iWebShop-5 up to 5.15.
Is there a fix for CVE-2026-86670?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86670 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86670?: Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a weak cryptographic algorithm (CWE-327) in password storage across multiple components: admin login (controllers/admin.php), system password creation (controllers/system.php), seller login (controllers/systemseller.php), user registration and password reset (controllers/simple.php and plugins/_userInfo/_userInfo.php). All password hashes use unsalted MD5 with direct digest comparison during authentication, making them trivially reversible once database access is obtained. Attack requires network access to the database or a secondary vulnerability exposing stored credentials; no authentication is needed if database backup is accessed separately. Exploitation is straightforward using freely available MD5 rainbow tables. The project was informed via GitHub issue on 2026-07-29 but has not patched as of the advisory publication date.

Affected products

aircheng-org iWebShop-5 up to 5.15

Timeline

2026-07-29: disclosed: Issue reported on GitHub
2026-09-08: advisory: Vulnerability advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.