CVE-2026-14919

ShopMonitor.io WordPress plugin before 1.2.0 is vulnerable: its test mode for email routing is gated by a trusted-source check that can be satisfied with client-supplied headers, allowing unauthenticated attackers to redirect outgoing emails (including the WordPress administrator password-reset) ...