EUVD-2026-51440
GHSA-g4w8-444w-x9q8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable test-mode endpoint with a spoofable header check needs no auth or interaction (AV:N/AC:L/PR:N/UI:N), and admin takeover yields full C/I/A impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.
Articles & Coverage 2
AnalysisAI
Administrator account takeover in the ShopMonitor.io WordPress plugin before 1.2.0 allows unauthenticated attackers to hijack outgoing emails. The plugin's email-rerouting test mode is gated only by a trusted-source check that can be satisfied with client-supplied request headers, so an attacker can redirect the WordPress administrator password-reset email to an address they control and seize the admin account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target site to be running ShopMonitor.io before 1.2.0 with the email-rerouting test mode reachable; the plugin's 'trusted-source' gate is satisfiable with client-supplied request headers, so no authentication and no user interaction are needed (CVSS PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends an unauthenticated HTTP request to the vulnerable site that toggles ShopMonitor.io's email-rerouting test mode, spoofing the trusted-source request header so the plugin accepts it. They then trigger a WordPress password reset for the administrator; the reset email is silently rerouted to the attacker's address, and they use the token to set a new admin password and take over the site. … |
| Remediation | Upgrade the ShopMonitor.io plugin to version 1.2.0 or later, which contains the vendor fix - Vendor-released patch: 1.2.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using ShopMonitor.io plugin and audit their current versions; immediately disable the plugin on any system running versions before 1.2.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today