CVE-2026-19907 | Shipo Plugin up to 1.8.0 on WordPress REST API authenticate_rest_user LOGGED_IN_COOKIE improper authorization

November 14, 2026 Yanac

A vulnerability marked as critical has been reported in Shipo Plugin up to 1.8.0 on WordPress. This issue affects the function authenticate_rest_user of the component REST API. The manipulation of the argument LOGGED_IN_COOKIE leads to improper authorization.

This vulnerability is documented as CVE-2026-19907. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More