CVE Watchtower


← Back to CVE List

CVE-2026-14919NVD

Vulnerability Summary

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.
Severity Level
CRITICAL(9.8)
Published Date
Jul 31, 2026
Last Modified
Jul 31, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.14%Probability
Root Weakness (CWE)
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh