CVE-2026-14919

ShopMonitor.io WordPress plugin before 1.2.0 is vulnerable: its test mode for email routing is gated by a trusted-source check that can be satisfied with client-supplied headers, allowing unauthenticated attackers to redirect outgoing emails (including the WordPress administrator password-reset) ...

CVE-2026-14919 ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress...