Email Rerouting Vulnerability in ShopMonitor.io WordPress Plugin
CVE-2026-14919
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 31 July 2026
Badges
What is CVE-2026-14919?
The ShopMonitor.io plugin for WordPress before version 1.2.0 contains a flaw that allows unauthorized users to exploit the email rerouting feature. This security gap allows attackers to redirect sensitive outgoing emails, such as password reset notifications for the WordPress administrator account, to an email address of their choosing. Since the security mechanism only checks client-supplied request headers, an attacker can easily bypass authentication controls, which may lead to complete control over the administrator account.
Affected Version(s)
ShopMonitor.io 0 < 1.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.