NivoCart CVE-2026-94107

Exploitation requires: (1) knowledge of a valid administrator's email address to seed the reset request; (2) the NivoCart admin password-reset feature (forgotten.php) being reachable, which is default behavior; (3) the attacker predicting or brute-forcing the 10-hex-character recovery code derived from substr(md5(mt_rand()),0,10) - feasible precisely because there is no rate limiting and no token expiration, allowing unlimited guesses and offline PRNG-seed prediction. Limiting factors: token prediction is non-trivial work (reflected as AC:H/AT:P), and the attacker must first obtain a legitimate admin email. No authentication and no user interaction are required (PR:N/UI:N). Applies to NivoCart through version 2.4.0.

This is a genuinely high-severity, unauthenticated administrative account-takeover flaw, not a CVSS-inflated low-risk issue. The vendor CVSS 4.0 vector (9.2, AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: exploitation is remote and pre-authentication (PR:N) but carries real complexity (AC:H/AT:P) because the attacker must predict or brute-force the mt_rand()-seeded token - 10 hex chars derived from ~31 bits of PRNG entropy - and must know a valid administrator email. The saving graces the vendor correctly encodes are that this is not a trivial one-shot: token prediction requires effort, which is why AC:H/AT:P are appropriate rather than AC:L. However, the absence of rate limiting and token expiration (stated in the description) materially lowers that barrier, making offline/online brute force practical. No EPSS score, no CISA KEV listing, and no explicit proof-of-concept exploit code are present in the provided data, so this is 'no public exploit identified at time of analysis' - the CWE-338 mechanism is fully documented in the VulnCheck advisory and linked source lines but weaponized code was not supplied. The dominant risk-limiting factor is product prevalence: NivoCart is an obscure open-source shopping cart, so despite the high technical impact this is a targeted-opportunity vulnerability rather than a mass-exploitation candidate.

An attacker who knows or guesses a NivoCart store administrator's email submits a password-reset request to admin/controller/common/forgotten.php, which generates a recovery code via substr(md5(mt_rand()), 0, 10). Because the token derives from a weak, predictable PRNG and there is no rate limiting or expiration, the attacker predicts or brute-forces the recovery code, completes the reset, and logs in with full administrative privileges. No public exploit code was identified in the provided sources, though the vulnerable code paths are published in the VulnCheck advisory and NivoCart GitHub source.