CVE-2026-112035: Weak Password Recovery in aircheng-org iWebShop-5

This vulnerability in aircheng-org iWebShop-5 (versions 5.0 through 5.16) involves the send_message_mobile function in the controllers/simple.php file. An attacker can manipulate the user_id parameter to bypass or weaken the password recovery mechanism, potentially allowing unauthorized password resets or account access. The vulnerability is remotely exploitable and has been publicly disclosed. The vendor has not issued a patch or official response as of the publication date.

The vulnerability allows remote attackers to exploit weak password recovery controls by manipulating the user_id parameter, which could lead to unauthorized password resets or account compromise. The CVSS 4.0 score of 5.3 indicates a medium impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality, integrity, and availability impacts are low to limited.

No official fix or patch is currently available from the vendor. Users of affected versions should monitor the vendor's channels for updates. Until a patch is released, consider restricting access to the password recovery functionality or implementing additional verification controls to mitigate exploitation risk.