CVE-2026-19907 is a critical (CVSS 9.8) authentication bypass in the Shipo plugin for WordPress, versions 1.6 through 1.8.0. An unauthenticated attacker who knows an existing username can impersonate that user, including an administrator, through the REST API.
What Is It
The flaw is in the plugin's authenticate_rest_user() function. It reads the LOGGED_IN_COOKIE value and logs in the user named there, but it never checks the cookie's cryptographic signature. That means an attacker can make up a cookie for any username they know.
The function is meant to apply only to the /wp-json/shipo/ route. That limit can be bypassed: an attacker puts that substring in the query string of an unrelated REST endpoint. Together, the two problems let an attacker act as the impersonated user anywhere in the REST API.
The weakness is classified as CWE-287 (Improper Authentication). Wordfence reported the issue, and NVD published the record on 2026-11-14.
Why It Matters
- Severity: CVSS 3.1 base score 9.8 (CRITICAL), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Low barrier: The attack works over the network, takes little effort, and needs no privileges or user interaction. The only thing the attacker needs is an existing username.
- Full site takeover: According to the advisory, an attacker can act as an administrator through the REST API, including creating another administrator account. That gives them persistent control of the site.
- Exploitation status: No CISA KEV entry was supplied for this CVE. Active exploitation is not confirmed by KEV at this time, and no KEV remediation deadline applies.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| shipo | Shipo (WordPress plugin) | 1.6 through 1.8.0 (inclusive) |
Versions before 1.6 are listed as unaffected. NVD lists no CPE entries, and the record's status is "Deferred."
Patch Status
The NVD record links to a WordPress plugin repository changeset (r3701532) for Shipo, which suggests a code change was made after the vulnerable range. However, the supplied data does not name a fixed version. Administrators should:
- Find out whether Shipo 1.6–1.8.0 is installed.
- Check the Wordfence advisory and the plugin changeset for the first patched release, and update to it.
- If no patched release is available yet, consider deactivating the plugin until one is.
Because the bypass lets an attacker create admin accounts, check affected sites for administrator accounts you don't recognize.