What is the CVSS score of EUVD-2026-51440?

EUVD-2026-51440 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ShopMonitor.io are affected by EUVD-2026-51440?

The ShopMonitor.io WordPress plugin (versions before 1.2.0) contains a critical vulnerability allowing unauthenticated attackers to hijack administrator accounts through email interception, with…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51440?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51440. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-51440?

Within 24 hours, identify all WordPress installations using ShopMonitor.io plugin and audit their current versions; immediately disable the plugin on any system running versions before 1.2.0. Within 7 days, upgrade all instances to ShopMonitor.io plugin version 1.2.0 or later and force password resets for all administrator accounts. Within 30 days, audit web server and email logs for any suspicious activity during the exposure window, such as unauthorized password-reset requests or login attempts from unfamiliar IP addresses.

ShopMonitor.io EUVD-2026-51440

| CVE-2026-14919 CRITICAL

Improper Authentication (CWE-287)

2026-07-31 WPScan

GHSA-g4w8-444w-x9q8

WordPress Authentication Bypass Shopmonitor Io

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable test-mode endpoint with a spoofable header check needs no auth or interaction (AV:N/AC:L/PR:N/UI:N), and admin takeover yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:24 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

9.8 (CRITICAL)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

CRITICAL 9.8

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

Articles & Coverage 2

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026 News Critical Authentication Bypass in WordPress ShopMonitor.io Plugin - CVE-2026-14919 Jul 31, 2026

AnalysisAI

Administrator account takeover in the ShopMonitor.io WordPress plugin before 1.2.0 allows unauthenticated attackers to hijack outgoing emails. The plugin's email-rerouting test mode is gated only by a trusted-source check that can be satisfied with client-supplied request headers, so an attacker can redirect the WordPress administrator password-reset email to an address they control and seize the admin account. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach plugin test-mode endpoint

Delivery

Spoof trusted-source request header

Exploit

Enable email rerouting to attacker address

Execution

Trigger admin password-reset email

Persist

Capture reset token

Impact

Take over administrator account

Access

Reach plugin test-mode endpoint

Delivery

Spoof trusted-source request header

Exploit

Enable email rerouting to attacker address

Execution

Trigger admin password-reset email

Persist

Capture reset token

Impact

Take over administrator account

Vulnerability AssessmentAI

Exploitation	Requires the target site to be running ShopMonitor.io before 1.2.0 with the email-rerouting test mode reachable; the plugin's 'trusted-source' gate is satisfiable with client-supplied request headers, so no authentication and no user interaction are needed (CVSS PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends an unauthenticated HTTP request to the vulnerable site that toggles ShopMonitor.io's email-rerouting test mode, spoofing the trusted-source request header so the plugin accepts it. They then trigger a WordPress password reset for the administrator; the reset email is silently rerouted to the attacker's address, and they use the token to set a new admin password and take over the site. …
Remediation	Upgrade the ShopMonitor.io plugin to version 1.2.0 or later, which contains the vendor fix - Vendor-released patch: 1.2.0. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all WordPress installations using ShopMonitor.io plugin and audit their current versions; immediately disable the plugin on any system running versions before 1.2.0. …

Threat intelligence, references, and detailed analysis are available after sign-in.