Search

Find a vulnerability

Search criteria

    2 vulnerabilities by shipo

    CVE-2026-19907 (GCVE-0-2026-19907)

    Vulnerability from nvd – Published: 2026-11-14 12:33 – Updated: 2026-11-14 12:33
    VLAI
    Title
    Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator
    Summary
    The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2457 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    shipo Shipo Affected: 1.6 , ≤ 1.8.0 (semver)
    		Create a notification for this product.
    Credits
    Nabil Irawan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Shipo",
          "vendor": "shipo",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "1.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie\u0027s cryptographic signature. The function\u0027s intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-14T12:33:23.699Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5ea515-5ae1-4771-9bfb-5a0f4b3fce22?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3701532/shipo"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-14T00:33:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19907",
    "datePublished": "2026-11-14T12:33:23.699Z",
    "dateReserved": "2026-08-14T19:56:29.273Z",
    "dateUpdated": "2026-11-14T12:33:23.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19907 (GCVE-0-2026-19907)

    Vulnerability from cvelistv5 – Published: 2026-11-14 12:33 – Updated: 2026-11-14 12:33
    VLAI
    Title
    Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator
    Summary
    The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2457 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    shipo Shipo Affected: 1.6 , ≤ 1.8.0 (semver)
    		Create a notification for this product.
    Credits
    Nabil Irawan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Shipo",
          "vendor": "shipo",
          "versions": [
            {
              "lessThanOrEqual": "1.8.0",
              "status": "affected",
              "version": "1.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie\u0027s cryptographic signature. The function\u0027s intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-14T12:33:23.699Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5ea515-5ae1-4771-9bfb-5a0f4b3fce22?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3701532/shipo"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-14T00:33:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-19907",
    "datePublished": "2026-11-14T12:33:23.699Z",
    "dateReserved": "2026-08-14T19:56:29.273Z",
    "dateUpdated": "2026-11-14T12:33:23.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}