{"id":"CVE-2026-19907","kind":"vulnerability","aliases":["CVE-2026-19907"],"related":[],"title":"Shipo WordPress plugin: unsigned login cookie lets attackers impersonate any user","description":"The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.","summary":"The Shipo WooCommerce shipping plugin for WordPress, versions 1.6 through 1.8.0, trusts the username in the login cookie without checking its signature. An unauthenticated attacker who knows a username can act as that user through the REST API, including creating a new administrator. Wordfence lists 1.8.1 as the patched version.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"shipo","fixed":["1.8.1"],"affected":">= 1.6, <= 1.8.0","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["authentication-bypass","other","shipo","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-1.8.1-or-later"],"how_to_check":"Run `wp plugin get shipo --field=version` or look in WP admin > Plugins. Versions 1.6 to 1.8.0 are vulnerable. Also look in Users for administrator accounts you do not recognise, and in the access logs for REST requests to /wp-json/ with 'shipo' in the query string.","fix":"Update Shipo to 1.8.1 or later (current release on wordpress.org is 1.8.4). Per Wordfence; the vendor changelog for 1.8.1 only says 'improvements to plugin security'. If you cannot update, deactivate the plugin.","status":"open","published_at":"2026-11-14T13:17:23+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","triaged_at":"2026-11-14T13:28:57+00:00","updated_at":"2026-11-14T13:30:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-14T13:28:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Shipo WordPress plugin: unsigned login cookie lets attackers impersonate any user","impact":"high","summary":"The Shipo plugin for WordPress, versions 1.6 through 1.8.0, trusts the username in the login cookie without checking its cryptographic signature. An unauthenticated attacker who knows a username, including an administrator's, can act as that user through the REST API and create a new administrator account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","shipo"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker becomes administrator and creates new admin accounts","analyst_note":"Confirm the fixed version and vendor advisory for Shipo beyond 1.8.0 at the NVD entry; sources do not state a fix.","how_to_check":"- Check whether the Shipo plugin is installed and its version in the WordPress admin plugins list, or with `wp plugin get shipo` if WP-CLI is available.\n- Confirm whether the installed version is between `1.6` and `1.8.0`.","plain_action":"","product_name":"Shipo","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Shipo plugin in versions 1.6 through 1.8.0 are exposed, because the plugin's REST authentication accepts the username in the login cookie without verifying its signature. Sites without the plugin, or running a version outside that range, are not affected by this description. The sources do not describe any extra configuration needed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00077,"input_tokens":4677,"output_tokens":604,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory for Shipo beyond 1.8.0 at the NVD entry; sources do not state a fix.","search":"'-19907':14A,17A '-2026':13A,16A '/wp-json/shipo':122C '1.6':34B,88C '1.8.0':36B,90C '1.8.1':71B 'account':173C 'act':56B 'action':164C 'administr':68B,160C,172C 'also':126C 'anoth':171C 'api':63B,168C 'attack':8A,50B,148C 'authent':20B,84C,96C,107C 'authentication-bypass':19B 'author':163C 'bypass':21B,85C,128C 'check':45B 'cooki':6A,43B,104C,114C 'creat':65B,170C 'cryptograph':116C 'cve':12A,15A 'due':93C 'endpoint':141C 'exist':152C 'function':99C,119C 'imperson':9A,155C 'includ':64B,158C,169C 'intend':121C 'know':52B,150C 'let':7A 'list':70B 'log':102C 'login':5A,42B 'make':143C 'name':109C 'new':67B 'pars':100C 'patch':74B 'perform':162C 'place':130C 'plugin':3A,30B,78C 'possibl':145C 'queri':135C 'rest':62B,97C,140C,167C 'restrict':124C 'rout':123C 'ship':29B 'shipo':1A,18A,23B,27B,77C 'signatur':47B,117C 'string':136C 'substr':132C 'trust':37B 'unauthent':49B,147C 'unrel':139C 'unsign':4A 'user':11A,59B,98C,110C,157C 'usernam':39B,54B,153C 'valu':105C 'verifi':112C 'version':33B,75B,87C 'vulner':82C 'without':44B,111C 'woocommerc':24B,28B 'wordfenc':69B 'wordpress':2A,25B,32B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Shipo plugin in versions 1.6 through 1.8.0 are exposed, because the plugin's REST authentication accepts the username in the login cookie without verifying its signature. Sites without the plugin, or running a version outside that range, are not affected by this description. The sources do not describe any extra configuration needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["shipo"],"ptokens":["shipo"],"labels":["authenticationbypass","critical","other","shipo","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-19907':14A,17A '-2026':13A,16A 'attack':8A 'cooki':6A 'cve':12A,15A 'imperson':9A 'let':7A 'login':5A 'plugin':3A 'shipo':1A,18A 'unsign':4A 'user':11A 'wordpress':2A","search_b":"'1.6':34B '1.8.0':36B '1.8.1':71B 'act':56B 'administr':68B 'api':63B 'attack':50B 'authent':20B 'authentication-bypass':19B 'bypass':21B 'check':45B 'cooki':43B 'creat':65B 'includ':64B 'know':52B 'list':70B 'login':42B 'new':67B 'patch':74B 'plugin':30B 'rest':62B 'ship':29B 'shipo':23B,27B 'signatur':47B 'trust':37B 'unauthent':49B 'user':59B 'usernam':39B,54B 'version':33B,75B 'without':44B 'woocommerc':24B,28B 'wordfenc':69B 'wordpress':25B,32B","search_c":"'/wp-json/shipo':122C '1.6':88C '1.8.0':90C 'account':173C 'action':164C 'administr':160C,172C 'also':126C 'anoth':171C 'api':168C 'attack':148C 'authent':84C,96C,107C 'author':163C 'bypass':85C,128C 'cooki':104C,114C 'creat':170C 'cryptograph':116C 'due':93C 'endpoint':141C 'exist':152C 'function':99C,119C 'imperson':155C 'includ':158C,169C 'intend':121C 'know':150C 'log':102C 'make':143C 'name':109C 'pars':100C 'perform':162C 'place':130C 'plugin':78C 'possibl':145C 'queri':135C 'rest':97C,140C,167C 'restrict':124C 'rout':123C 'shipo':77C 'signatur':117C 'string':136C 'substr':132C 'unauthent':147C 'unrel':139C 'user':98C,110C,157C 'usernam':153C 'valu':105C 'verifi':112C 'version':87C 'vulner':82C 'without':111C 'wordpress':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19907","severity":null,"published_at":"2026-11-14T13:17:23+00:00","modified_at":"2026-11-14T13:17:23+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","fetched_at":"2026-11-14T13:28:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-19907:3980","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shipo/shipo-16-180-authentication-bypass-to-administrator","severity":null,"published_at":"2026-11-14T13:30:51+00:00","modified_at":"2026-11-14T13:30:51+00:00","first_seen_at":"2026-11-14T13:30:51+00:00","fetched_at":"2026-11-14T13:30:51+00:00","note":"Wordfence (third party) gives affected 1.6-1.8.0, patched 1.8.1; wordpress.org changelog lists 1.8.1 'improvements to plugin security' and current 1.8.4. No vendor advisory or CVE-specific vendor statement found, so nothing marked verified. No exploitation or PoC seen; not in KEV. Did not search X.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shipo/shipo-16-180-authentication-bypass-to-administrator","https://wordpress.org/plugins/shipo/"]}],"documents":[{"id":155861,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shipo/shipo-16-180-authentication-bypass-to-administrator","title":"Wordfence: Shipo 1.6 - 1.8.0 Authentication Bypass to Administrator","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":155862,"url":"https://wordpress.org/plugins/shipo/","title":"Shipo plugin page and changelog (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}