Is CVE-2026-94105 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94105 being exploited in the wild.

How severe is CVE-2026-94105?

Medium severity, with a CVSS score of 5.3, published 20 September 2026.

Is there a fix for CVE-2026-94105?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-94105 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-94105?

Check whether you run NivoCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94105: NivoCart admin password reset configuration write

CVE-2026-94105 · Severity: medium · CVSS 5.3 · Published 2026-09-20

NivoCart is a PHP-based shopping cart system used by small and medium businesses to manage online sales. An unauthenticated attacker can disable password recovery by sending a request with an invalid code to the admin password reset function, which overwrites a configuration setting that controls self-service password recovery. This prevents administrators and users from resetting forgotten passwords until a site administrator manually re-enables the feature, potentially locking legitimate users out of their accounts.

Technologies: NivoCart. Vendors: NivoCart.

Quick answers

Is CVE-2026-94105 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94105 being exploited in the wild.
How severe is CVE-2026-94105?: Medium severity, with a CVSS score of 5.3, published 20 September 2026.
Which products and versions are affected?: NivoCart through 2.4.0.
Is there a fix for CVE-2026-94105?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-94105 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-94105?: Check whether you run NivoCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The admin password reset controller fails to validate the reset code parameter before processing it, allowing an unauthenticated GET request with a missing or malformed code to trigger a config write that sets config_password to 0. The vulnerability exists in the reset.php controller which checks if a user exists for the given code but proceeds to disable password recovery on invalid input. An attacker needs only network access to the admin password reset endpoint; no authentication or user interaction is required.

Affected products

NivoCart NivoCart through 2.4.0

Timeline

2026-09-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.