A warning was published about a flaw in shipo
KROMSE explanation
shipo has a critical security flaw (CVE-2026-19907, CVSS 9.8). The official record says: The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's cryptographic signature.
No confirmed attacks and no public attack code yet.
Anyone running shipo.
- Install the maker's update for shipo as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
