CVE-2026-112034: aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/userInfo/userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
aircheng-org iWebShop-5 versions up to and including 5.16 are identified as affected. The issue is in the Login Redirect component, specifically plugins/_userInfo/_userInfo.php.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require privileges. Exploitation requires a victim to interact with the crafted redirect, as reflected by the user-interaction requirement.
Is public exploitation material available?
Yes. Public exploit material is reported as available, so the issue could be used in attacks.
What should teams do if no fix is available?
The project was notified through an issue report but had not responded at the time of publication. Until an update is available, review and restrict untrusted callback values used by the affected login redirect flow, and monitor for unexpected external redirect destinations.