Authentication Bypass Vulnerability in Shipo Plugin for WordPress

CVE-2026-19907

What is CVE-2026-19907?

The Shipo plugin for WordPress is susceptible to an Authentication Bypass exploit across versions 1.6 to 1.8.0. This vulnerability arises from the authenticate_rest_user() function, which inadequately verifies the cryptographic signature of the LOGGED_IN_COOKIE. As a result, attackers can impersonate valid users, including administrators, by crafting requests to the REST API. This flaw allows unauthorized actions, such as creating new administrator accounts, by appending the /wp-json/shipo/ route in the query string of unrelated REST endpoints. For further details, please refer to the relevant resources.

References