---
id: "CVE-2026-19907"
page: "https://infrastack.ai/live/CVE-2026-19907"
kind: "vulnerability"
aliases: ["CVE-2026-19907"]
title: "Shipo WordPress plugin: unsigned login cookie lets attackers impersonate any user"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "shipo", "fixed": ["1.8.1"], "affected": ">= 1.6, <= 1.8.0", "ecosystem": "wordpress"}]
ecosystems: ["vendor"]
tags: ["authentication-bypass", "other", "shipo", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.8.1-or-later"]
published_at: "2026-11-14T13:17:23+00:00"
first_seen_at: "2026-11-14T13:28:10+00:00"
updated_at: "2026-11-14T13:30:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19907", "first_seen_at": "2026-11-14T13:28:10+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shipo/shipo-16-180-authentication-bypass-to-administrator", "first_seen_at": "2026-11-14T13:30:51+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shipo/shipo-16-180-authentication-bypass-to-administrator", "https://wordpress.org/plugins/shipo/"]}]
exploit_sources: []
---

# Shipo WordPress plugin: unsigned login cookie lets attackers impersonate any user

Link for people: https://infrastack.ai/live/CVE-2026-19907 (this .md is for agents)

The Shipo WooCommerce shipping plugin for WordPress, versions 1.6 through 1.8.0, trusts the username in the login cookie without checking its signature. An unauthenticated attacker who knows a username can act as that user through the REST API, including creating a new administrator. Wordfence lists 1.8.1 as the patched version.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:shipo affected >= 1.6, <= 1.8.0 fixed 1.8.1

## How to check

Run `wp plugin get shipo --field=version` or look in WP admin > Plugins. Versions 1.6 to 1.8.0 are vulnerable. Also look in Users for administrator accounts you do not recognise, and in the access logs for REST requests to /wp-json/ with 'shipo' in the query string.

## Fix

Update Shipo to 1.8.1 or later (current release on wordpress.org is 1.8.4). Per Wordfence; the vendor changelog for 1.8.1 only says 'improvements to plugin security'. If you cannot update, deactivate the plugin.

## Timeline

- 2026-11-14T13:28:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19907
- 2026-11-14T13:30:51+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shipo/shipo-16-180-authentication-bypass-to-administrator — Wordfence (third party) gives affected 1.6-1.8.0, patched 1.8.1; wordpress.org changelog lists 1.8.1 'improvements to plugin security' and current 1.8.4. No vendor advisory or CVE-specific vendor statement found, so nothing marked verified. No exploitation or PoC seen; not in KEV. Did not search X.

## Documents

- [advisory] Wordfence: Shipo 1.6 - 1.8.0 Authentication Bypass to Administrator https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shipo/shipo-16-180-authentication-bypass-to-administrator
- [fix] Shipo plugin page and changelog (wordpress.org) https://wordpress.org/plugins/shipo/

## From the sources

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_