CVE-2026-94107 nivocart CVE debrief

Who should care

Defenders responsible for NivoCart installations, particularly those using version 2.4.0 or earlier, should assess exposure and prioritize patching or mitigation. They should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should verify the presence of this vulnerability in their NivoCart installations and review compensating controls for exposed systems while remediation is  

Why it matters

CVE-2026-94107 is a critical vulnerability in NivoCart that allows attackers to predict password reset tokens and gain administrative access. Defenders should prioritize verification and patching of affected installations.

• Potential unauthorized administrative access to NivoCart installations.
• Possible lateral movement within environments where NivoCart is used.
• Need for verification of NivoCart version and patch status.
• Potential for exploitation without rate limiting or expiration.

Technical summary

The vulnerability generates recovery codes using substr(md5(mt_rand()), 0, 10) in the forgotten.php endpoint of NivoCart through 2.4.0. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration. This vulnerability allows attackers to gain unauthorized administrative access to NivoCart installations. Defenders should prioritize verifying the presence of this vulnerability in their NivoCart installations and apply patches or mitigations as available.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their NivoCart installations and apply patches or mitigations as available.

Recommended defensive actions

• Verify the presence of NivoCart version 2.4.0 or earlier in your environment.
• Check for and apply any available patches or updates for NivoCart.
• Implement additional security measures such as rate limiting and token expiration for password reset functionality.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source references provide details on the predictable password reset token vulnerability in NivoCart through 2.4.0. Defenders should verify the presence of this vulnerability in their NivoCart installations and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The vulnerability generates recovery codes using substr(md5(mt_rand()), 0, 10) in the forgotten.php endpoint. Attackers who know an administrator's email address can request a password reset and may  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.