CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

  • Published Sep 20, 2026
  • CVSS 9.2 critical
  • 0.6% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-94107 at the National Vulnerability Database