CSRF Vulnerability in ShopEngine Elementor WooCommerce Builder Addon by WordPress
CVE-2026-19088
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 August 2026
Badges
What is CVE-2026-19088?
The ShopEngine Elementor WooCommerce Builder Addon for WordPress lacks adequate protection for its authentication endpoints, making it susceptible to Cross-Site Request Forgery (CSRF) attacks. An attacker can exploit this vulnerability to trick a victim into authenticating to an attacker-controlled account. Consequently, any billing and shipping information the victim submits during checkout may be redirected and stored under the attacker's account, compromising the victim's personal data and exposing sensitive information.
Affected Version(s)
ShopEngine Elementor WooCommerce Builder Addon 0 < 4.9.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.