EUVD-2026-51440
GHSA-g4w8-444w-x9q8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin test-mode endpoint
-
DeliverySpoof trusted-source request header
-
ExploitEnable email rerouting to attacker address
-
ExecutionTrigger admin password-reset email
-
PersistCapture reset token
-
ImpactTake over administrator account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target site to be running ShopMonitor.io before 1.2.0 with the email-rerouting test mode reachable; the plugin's 'trusted-source' gate is satisfiable with client-supplied request headers, so no authentication and no user interaction are needed (CVSS PR:N/UI:N). The concrete prerequisite is the ability to reach the plugin's test-mode email endpoint over the network and forge the header(s) it checks; the practical limiting factor is simply whether the vulnerable plugin is installed and active - there is no additional non-default configuration, platform, or privilege barrier described. |
| Impact | The signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack yielding full admin compromise - a textbook critical. A working POC is publicly available (WPScan), which raises practical exploitability. Counterbalancing this, EPSS is only 0.14% (4th percentile) and the CVE is NOT in CISA KEV, so there is currently no evidence of widespread active exploitation; the low EPSS most plausibly reflects the niche deployment footprint of this specific plugin rather than any weakness in the attack itself. No SSVC decision record was provided in the input, so exploitation-automatability and technical-impact fields cannot be independently cited. Net: for any site actually running vulnerable ShopMonitor.io this is a high-priority patch (full admin takeover, POC in hand); across the broader population the aggregate risk is bounded by the product's limited prevalence. |
| Exploit ScenarioDerived | An attacker sends an unauthenticated HTTP request to the vulnerable site that toggles ShopMonitor.io's email-rerouting test mode, spoofing the trusted-source request header so the plugin accepts it. They then trigger a WordPress password reset for the administrator; the reset email is silently rerouted to the attacker's address, and they use the token to set a new admin password and take over the site. A public POC for this flow is available via WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Administrator account takeover in the ShopMonitor.io WordPress plugin before 1.2.0 allows unauthenticated attackers to hijack outgoing emails. The plugin's email-rerouting test mode is gated only by a trusted-source check that can be satisfied with client-supplied request headers, so an attacker can redirect the WordPress administrator password-reset email to an address they control and seize the admin account. Rated CVSS 9.8 with publicly available exploit code; EPSS is low (0.14%, 4th percentile), and it is not listed in CISA KEV - no public exploit identified as actively used at time of analysis, though POC exists.
RemediationAI
Upgrade the ShopMonitor.io plugin to version 1.2.0 or later, which contains the vendor fix - Vendor-released patch: 1.2.0. Consult the WPScan advisory (https://wpscan.com/vulnerability/6d929535-9757-44ae-8c58-682f1eb89785/) for confirmation before deploying. If immediate upgrade is not possible, deactivate the ShopMonitor.io plugin entirely (the most reliable stopgap, at the cost of losing shop-monitoring integration); alternatively restrict access to the plugin's email test-mode endpoint at the web/WAF layer and block or sanitize the client-supplied headers used in the trusted-source check so they cannot be spoofed (this may break legitimate integration callbacks that rely on those headers). As a defensive complement, enforce two-factor authentication on administrator accounts and monitor for unexpected password-reset requests so that an intercepted reset link alone does not grant access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin (ShopMonitor.io) that integrates a WordPress site with an external shop-monitoring service. The root cause maps to CWE-287 (Improper Authentication): the plugin restricts its email-rerouting 'test mode' behind a trusted-source verification, but that verification relies on request headers (e.g. an IP/host or origin header) that the client fully controls and can spoof. Because WordPress delivers security-sensitive messages - most critically the administrator password-reset link - through the site's mail pipeline, an attacker who can silently reroute that mail flow intercepts the reset token. The CPE 'cpe:2.3:a:unknown:shopmonitor.io:*:*:*:*:*:*:*:*' identifies all versions prior to the fix, with the vendor field unresolved in NVD.
Know when Shopmonitor Io gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable test-mode endpoint with a spoofable header check needs no auth or interaction (AV:N/AC:L/PR:N/UI:N), and admin takeover yields full C/I/A impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.
Articles & Coverage 2
Executive ViewAI
The ShopMonitor.io WordPress plugin (versions before 1.2.0) contains a critical vulnerability allowing unauthenticated attackers to hijack administrator accounts through email interception, with publicly available exploit code existing. An attacker can redirect the admin password-reset email and gain complete control of affected WordPress sites. This poses immediate risk to any organization running the vulnerable plugin, enabling potential data theft and site defacement.
Apply vendor patch: ShopMonitor.io WordPress plugin version 1.2.0 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB