CVE-2026-19907

The Shipo plugin for WordPress (versions 1.6 through 1.8.0 ) is vulnerable to an Authentication Bypass that can lead to Administrator privileges. The root cause is the authenticate_rest_user() function, which parses the LOGGED_IN_COOKIE value and authenticates the named user without verifying the...

WordPress Shipo plugin 1.6-1.8.0 - Authentication Bypass to Administrator vulnerability

Authentication Bypass to Administrator vulnerability discovered by Nabil Irawan in WordPress Plugin Shipo versions 1.6-1.8.0...