CVE-2026-19088
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before version 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
Risk Assessment
An attacker can intercept customers' personal and address data, violating privacy and potentially leading to identity theft or fraud.
Recommendation
Update the ShopEngine plugin to version 4.9.3 or later, which includes the fix. Additionally, implement additional CSRF protections if possible.
Original NVD description (English source)
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.