CVE-2026-19907: Authentication Bypass Vulnerability in Shipo Plugin for WordPress

What happened?

The Shipo plugin for WordPress has a critical vulnerability that allows authentication bypass. This flaw affects versions 1.6 through 1.8.0 and enables unauthenticated attackers to impersonate existing users, including administrators, via the REST API.

How does the vulnerability work?

The vulnerability lies in the authenticate_rest_user() function, which parses the LOGGED_IN_COOKIE value and authenticates the named user without verifying the cryptographic signature of the cookie. Additionally, the intended route restriction of /wp-json/shipo/ can be bypassed by placing that substring in the query string of an unrelated REST endpoint.

What is the real impact?

This vulnerability allows unauthenticated attackers who know an existing username to impersonate that user, performing authorized actions through the REST API. This includes creating new administrator accounts, posing a significant risk to the security of any WordPress installation using this plugin.

Which versions are affected?

• 1.6
• 1.7
• 1.8.0

How to fix

1. Check the version of the Shipo plugin installed on your WordPress site.
2. Update the plugin to the latest available version that addresses this vulnerability.
3. Consider disabling the Shipo plugin until an official fix is available.
4. Monitor WordPress and Shipo plugin security advisories for updates.

Mitigation while waiting to update

While waiting to update, it is recommended to disable the Shipo plugin and review user permissions on your WordPress site to limit access to administrative accounts.

Conclusion

The CVE-2026-19907 vulnerability in the Shipo plugin for WordPress poses a critical risk that must be addressed urgently. It is essential to keep plugins updated and monitor vulnerabilities to protect the integrity of your site.