Read the docs
TI-2026-63321 Aliases CVE-2026-94105GHSA-6h55-m3v5-vrcr

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

Priority LOW 37CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nivocartnivocartup to 2.4.0—No fix listedCNA
  • nivocart Vendornivocart Affected up to 2.4.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94105
  2. 2026-10-03 Alias added: GHSA-6h55-m3v5-vrcr

References

Other 4

  • TI-2026-75058 Missing authorization in NivoCart exposes guest order invoices CVSS 4.0HIGH 8.7
  • TI-2026-63323 NivoCart through 2.4.0 Predictable Administrator Password Reset Token CVSS 4.0CRITICAL 9.2
  • TI-2026-63320 NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager CVSS 4.0HIGH 8.7
  • TI-2026-75059 CAPTCHA bypass in NivoCart exposes answer in page HTML CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences