Security Alert Summary
The ShopMonitor.io WordPress plugin before 1.2.0 contains an email-rerouting test-mode vulnerability that can be triggered by unauthenticated actors. An attacker able to supply crafted request headers can satisfy a trusted-source check and cause outgoing emails, including administrator password-reset messages, to be redirected to an address they control, potentially leading to administrator account takeover.
CVE Details
- CVE ID:
CVE-2026-14919 - Affected component: ShopMonitor.io WordPress plugin
- Affected versions: Versions less than 1.2.0 (semver)
- Published: July 31, 2026 at 07:16:25 AM
- Last modified: July 31, 2026 at 07:16:25 AM
- CVSS v3.1: Not provided in the CVE data
- Authentication / privileges / user interaction: No authentication required (unauthenticated attacker); no privileges required; no user interaction required to trigger the condition
- Primary impact: Confidentiality and Integrity (unauthorized disclosure or redirection of email leading to possible account takeover); Availability: none indicated
- CWE / weakness ID: Not provided in the CVE data
Technical Details
The plugin implements an email-rerouting test mode that is intended to be gated behind a trusted-source check. The trusted-source check can be satisfied using client-supplied request headers, which allows an attacker to cause the plugin to reroute outgoing emails to an attacker-controlled address. The CVE description specifically notes the ability to redirect outgoing emails including the WordPress administrator password-reset email. Because password-reset messages are sent to the account owner by email, redirecting that message enables the attacker to receive the reset link and complete an administrator account takeover. The issue exists due to insufficient validation of the origin/trusted-source check and reliance on headers that can be controlled by a client.
How This Could Impact Your Website
Consider a small site with a site owner, several internal staff members with editor or contributor roles, and an external contractor who performs development or support. If an attacker can trigger the rerouting behavior, they could receive password-reset emails sent to an administrator. In practice, this could lead to:
- Exposure of administrator or other user email-based communications.
- Unauthorized receipt of password-reset links, enabling account takeover of privileged users.
- Increased risk of targeted phishing or social engineering campaigns using knowledge of internal users and roles.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any accounts with elevated privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and email sending logs for unusual behavior, such as unexpected destination addresses for password-reset emails.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
