CVE-2026-19088
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before version 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
Risk Assessment
An attacker can intercept customers' personal and address data, violating privacy and potentially leading to identity theft or fraud.
Recommendation
Update the ShopEngine plugin to version 4.9.3 or later, which includes the fix. Additionally, implement additional CSRF protections if possible.
Other vulnerabilities in ShopEngine Elementor WooCommerce Builder Addon
See all- CVE-2025-12358Medium
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. Missing nonce validation on the "post_add_to_list" function and an incorrect permissions callback in the "Api/init" function allow an unauthenticated attacker to add or remove products from a user's wishlist via a forged request if they trick a site user into clicking a link.
- CVE-2025-10173Low
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
Original NVD description (English source)
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS