Shipo 1.6 — 1.8.0 - Authentication Bypass to Administrator

Overview

Advisory ID

CVE-2026-19907

Product

Shipo shipo

Affected

1.6 – 1.8.0

Fixed in

1.8.1

Weakness

CWE-287 Improper Authentication

Required access

No account needed

Published

Nov 14, 2026

Credit

Nabil Irawan

Source

Wordfence Intelligence

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the authenticate_rest_user() function parsing the LOGGED_IN_COOKIE value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended /wp-json/shipo/ route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to version 1.8.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.