CVE-2026-19088 — ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

CVE-2026-19088

ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication PUBLISHED

Description (CNA)

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

Affected (CNA)

Vendor / product	Versions
Unknown / ShopEngine Elementor WooCommerce Builder Addon	affected 0 before 4.9.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f58066e9-8066-43bc-8778-7ded279e8ee2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.