---
id: "CVE-2026-112035"
kind: "vulnerability"
aliases: ["CVE-2026-112035"]
title: "iWebShop 5: weak password recovery lets remote users reach other accounts"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["e-commerce", "iwebshop", "other", "php", "self-hosted"]
not_affected_if: ["versions-above-5.16"]
published_at: "2026-10-19T01:16:37+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:57:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112035", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# iWebShop 5: weak password recovery lets remote users reach other accounts

iWebShop 5 up to 5.16 has a flaw in the send_message_mobile function of controllers/simple.php, where the user_id argument is manipulated to abuse password recovery. A remote attacker can exploit it, and the exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed version is `5.16` or older.
- Look at `controllers/simple.php` for the `send_message_mobile` function and check whether the `user_id` argument is used unchecked.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112035

## From the sources

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_