Field brief
WordPress Shipo plugin vulnerable to authentication bypass
A newly published CVE exposes a critical authentication bypass in the Shipo plugin, affecting WordPress sites running versions 1.6 through 1.8.0.
The Shipo plugin for WordPress is now listed as CVE‑2026‑19907, a critical authentication bypass that allows an unauthenticated attacker to impersonate any user, including administrators, by exploiting a flaw in the `authenticate_rest_user()` function. The vulnerability affects plugin versions 1.6 through 1.8.0 and is rated 9.8 on the CVSS scale. No vendor advisory or fixed version is currently available, and the CISA KEV catalog does not list it. WordPress site owners should immediately upgrade to the latest Shipo release or remove the plugin if no update is forthcoming. This vulnerability is documented in the NVD record and has not yet been addressed by the plugin developer. Action: Update the Shipo plugin to the newest version or uninstall it to eliminate the risk. CVE-2026-19907 NVD record
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.