CVE-2026-19907

The Shipo plugin for WordPress (versions 1.6 through 1.8.0 ) is vulnerable to an Authentication Bypass that can lead to Administrator privileges. The root cause is the authenticate_rest_user() function, which parses the LOGGED_IN_COOKIE value and authenticates the named user without verifying the...