External risk intelligence

ShopMonitor WordPress Plugin Email Rerouting Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-14919

The vulnerability exists in a WordPress plugin. WordPress installations and their associated plugins are commonly deployed as public-facing web applications accessible via the internet, making this functionality reachable by remote attackers.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a WordPress plugin that could allow unauthorized individuals to redirect outgoing emails, including password reset notifications. This could potentially lead to account takeovers. The primary concern is to confirm if this specific plugin is in use and exposed.

Plugin flaw allows email redirection.
Account takeover risk if exploited.
Confirm usage and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can trick the ShopMonitor.io WordPress plugin into sending outgoing emails, including password reset emails, to an address they control. This is possible by bypassing a check that is supposed to restrict this functionality to trusted sources, ultimately allowing the attacker to take over the administrator account.

Attacker can access the plugin via the network.
Vulnerability triggered by sending crafted request headers.
Risk of full administrator account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the ShopMonitor.io WordPress plugin could allow an unauthenticated attacker to redirect outgoing emails, including password reset emails, to an attacker-controlled address. This could lead to the takeover of the WordPress administrator account.

Administrator account access.
Emails rerouted via trusted-source check bypass.
Loss of administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the ShopMonitor.io WordPress plugin allows unauthenticated attackers to redirect sensitive emails, including password resets, leading to account takeover. Application owners and infrastructure teams are likely responsible for managing WordPress instances and their plugins. The first practical step is to identify all ShopMonitor.io plugin installations, confirm their reachability and business criticality, and then coordinate remediation with the accountable team, potentially involving vendor communication.

Identify and confirm affected installations.
Verify exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ShopMonitor.io plugin for WordPress?

ShopMonitor.io is an add-on component for WordPress sites that manages specific store-related monitoring tasks. It functions within the WordPress ecosystem to oversee outgoing communications and site activity. Users typically install this plugin to gain better visibility into store operations and automated messaging flows.

What does CWE-287 mean for CVE-2026-14919?

This vulnerability involves Improper Authentication, categorized as CWE-287. In the context of this CVE, it means the plugin fails to correctly verify the identity of the person requesting changes. Because the security check relies on information that a remote user can easily manipulate, the system incorrectly trusts unauthorized requests as if they came from a legitimate administrator.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted request headers to the plugin. By manipulating these headers, they bypass the intended security checks that restrict the email-rerouting feature to trusted sources. It is important to note that performing standard administrative tasks through the official WordPress dashboard does not trigger this flaw; the issue specifically exists within the plugin's flawed validation logic for external network requests.

Why should I care about CVE-2026-14919?

Halo Surface Signal notes that since this plugin is designed for WordPress, it is frequently deployed on web applications that are reachable via the internet. Because the vulnerability is accessible over the network without requiring a login, anyone on the internet could potentially redirect critical system emails. This makes it a high-priority concern for any site owner using the plugin, as it allows attackers to intercept password reset links and gain full control of the account.

Do I need to check my sites for ShopMonitor.io?

Yes. Your first step is to inventory your WordPress environments to determine if the ShopMonitor.io plugin is active. Once identified, verify if the installation is reachable from the internet, as this increases the risk level. After confirming the presence and exposure of the plugin, coordinate with your technical team to disable the affected functionality or update the plugin to a version beyond 1.1.9 to resolve the flaw.

References

wpscan.com/vulnerability/6d929535-9757-44ae-8c58-682f1eb89785/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.