CVE-2026-94107: Nivocart

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Affected products

• Nivocart Nivocart: up to and including 2.4.0

Published 2026-09-20. Last modified 2026-09-22.