A critical authentication flaw in Shipo, a WooCommerce shipping plugin, can let an unauthenticated attacker impersonate an existing WordPress user. Wordfence’s November 14 advisory identifies the issue as CVE-2026-19907 and rates it 9.8.
The vulnerable REST authentication function accepts the username carried in a login cookie without checking its cryptographic signature. A separate route restriction can also be bypassed, extending the behavior beyond the plugin’s intended endpoints.
An attacker needs to know an existing username. Impersonating an administrator could allow privileged REST API operations, including creation of another administrator account.
Wordfence lists versions 1.6 through 1.8.0 as affected and identifies 1.8.1 as the first patched release. The official plugin changelog describes security improvements in that version and lists newer releases.
Site owners should update to a current patched version. The advisory does not report confirmed exploitation in the wild.
