What is the CVSS score of CVE-2026-14919?

CVE-2026-14919 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ShopMonitor.io are affected by CVE-2026-14919?

The ShopMonitor.io WordPress plugin (versions before 1.2.0) contains a critical vulnerability allowing unauthenticated attackers to hijack administrator accounts through email interception, with…. A patch is available.

Is there a public PoC exploit available for CVE-2026-14919?

Yes, a public proof-of-concept exploit is available for CVE-2026-14919. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14919?

Within 24 hours, identify all WordPress installations using ShopMonitor.io plugin and audit their current versions; immediately disable the plugin on any system running versions before 1.2.0. Within 7 days, upgrade all instances to ShopMonitor.io plugin version 1.2.0 or later and force password resets for all administrator accounts. Within 30 days, audit web server and email logs for any suspicious activity during the exposure window, such as unauthorized password-reset requests or login attempts from unfamiliar IP addresses.

ShopMonitor.io CVE-2026-14919

EUVD-2026-51440 CRITICAL

Improper Authentication (CWE-287)

2026-07-31 WPScan

GHSA-g4w8-444w-x9q8

WordPress Authentication Bypass Shopmonitor Io Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable test-mode endpoint with a spoofable header check needs no auth or interaction (AV:N/AC:L/PR:N/UI:N), and admin takeover yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:24 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

9.8 (CRITICAL)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

Articles & Coverage 2

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026 News Critical Authentication Bypass in WordPress ShopMonitor.io Plugin - CVE-2026-14919 Jul 31, 2026

AnalysisAI

Administrator account takeover in the ShopMonitor.io WordPress plugin before 1.2.0 allows unauthenticated attackers to hijack outgoing emails. The plugin's email-rerouting test mode is gated only by a trusted-source check that can be satisfied with client-supplied request headers, so an attacker can redirect the WordPress administrator password-reset email to an address they control and seize the admin account. Rated CVSS 9.8 with publicly available exploit code; EPSS is low (0.14%, 4th percentile), and it is not listed in CISA KEV - no public exploit identified as actively used at time of analysis, though POC exists.

Technical ContextAI

The affected component is a WordPress plugin (ShopMonitor.io) that integrates a WordPress site with an external shop-monitoring service. The root cause maps to CWE-287 (Improper Authentication): the plugin restricts its email-rerouting 'test mode' behind a trusted-source verification, but that verification relies on request headers (e.g. an IP/host or origin header) that the client fully controls and can spoof. Because WordPress delivers security-sensitive messages - most critically the administrator password-reset link - through the site's mail pipeline, an attacker who can silently reroute that mail flow intercepts the reset token. The CPE 'cpe:2.3:a:unknown:shopmonitor.io:*:*:*:*:*:*:*:*' identifies all versions prior to the fix, with the vendor field unresolved in NVD.

RemediationAI

Upgrade the ShopMonitor.io plugin to version 1.2.0 or later, which contains the vendor fix - Vendor-released patch: 1.2.0. Consult the WPScan advisory (https://wpscan.com/vulnerability/6d929535-9757-44ae-8c58-682f1eb89785/) for confirmation before deploying. If immediate upgrade is not possible, deactivate the ShopMonitor.io plugin entirely (the most reliable stopgap, at the cost of losing shop-monitoring integration); alternatively restrict access to the plugin's email test-mode endpoint at the web/WAF layer and block or sanitize the client-supplied headers used in the trusted-source check so they cannot be spoofed (this may break legitimate integration callbacks that rely on those headers). As a defensive complement, enforce two-factor authentication on administrator accounts and monitor for unexpected password-reset requests so that an intercepted reset link alone does not grant access.