Nivocart Through 2.4.0 Predictable Administrator Password Reset Token

Back www.vulncheck.com

Nivocart Through 2.4.0 Predictable Administrator Password Reset Token

www.vulncheck.com • September 20, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Found in NivoCart Affecting Admin Access NivoCart versions up to 2.4.0 are affected by two vulnerabilities, CVE-2026-94105 and CVE-2026-94107, both published on 2026-09-20. CVE-2026-94105 is a medium-severity vulnerability allowing unauthenticated attackers to disable password recovery by manipulating the admin password reset controller. CVE-2026-94107 presents a high-risk predictable password reset token vulnerability, enabling attackers to gain unauthorized administrative access by predicting recovery tokens. Both vulnerabilities impact internet-facing shops using NivoCart, particularly those with exposed recovery endpoints. The current status indicates that no active exploitation has been confirmed for CVE-2026-94105, while CVE-2026-94107 has not been confirmed as actively exploited either. Immediate remediation is recommended for both vulnerabilities. 2 sources 59

Extracted Entities

Vulnerabilities (1)

Predictable Administrator Password Reset Token Vulnerability