CVE-2026-14919
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The ShopMonitor.io WordPress plugin before version 1.2.0 improperly restricts its email-rerouting test mode, relying on client-supplied request headers. Unauthenticated attackers can redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.
Risk Assessment
Attackers can take over the WordPress administrator account, gaining full control over the site, potentially leading to data theft, defacement, or further attacks.
Recommendation
Update the ShopMonitor.io plugin to version 1.2.0 or later, which fixes the email rerouting source verification mechanism.
Original NVD description (English source)
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.