SHIPO · CVE-2026-19907 · Other
FIX → 1.8.1
The Shipo WooCommerce shipping plugin for WordPress, versions 1.6 through 1.8.0, trusts the username in the login cookie without checking its signature. An unauthenticated attacker who knows a username can act as that user through the REST API, including creating a new administrator. Wordfence lists 1.8.1 as the patched version.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Shipo plugin in versions 1.6 through 1.8.0 are exposed, because the plugin's REST authentication accepts the username in the login cookie without verifying its signature. Sites without the plugin, or running a version outside that range, are not affected by this description. The sources do not describe any extra configuration needed.
Not affected if plugin-not-installed, version-1.8.1-or-later
Who cares authentication-bypass, shipo, woocommerce, wordpress
Run wp plugin get shipo --field=version or look in WP admin > Plugins. Versions 1.6 to 1.8.0 are vulnerable. Also look in Users for administrator accounts you do not recognise, and in the access logs for REST requests to /wp-json/ with 'shipo' in the query string.
Upgrade to 1.8.1
1.8.1 or later (current release on wordpress.org is 1.8.4)1.8.1 only says The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the authenticate_rest_user() function parsing the LOGGED_IN_COOKIE value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended /wp-json/shipo/ route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
improvements to plugin securityNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.