{"id":"CVE-2026-19088","aliases":["EUVD-2026-57729","GHSA-mhv4-gprf-7m48"],"status":"published","title":"ShopEngine \u003c 4.9.3 - Customer PII Disclosure via Forced Authentication","description":"The ShopEngine Elementor WooCommerce Builder Addon  WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00143,"percentile":0.03676,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2026-08-13T06:00:13Z","modified":"2026-08-26T16:30:52Z","products":[{"vendor":"unknown","product":"shopengine elementor woocommerce builder addon"}],"references":[{"url":"https://wpscan.com/vulnerability/f58066e9-8066-43bc-8778-7ded279e8ee2/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19088"},{"url":"https://wpscan.com/vulnerability/f58066e9-8066-43bc-8778-7ded279e8ee2"},{"url":"https://github.com/advisories/GHSA-mhv4-gprf-7m48"}],"sources":{"cve":[{"id":"CVE-2026-19088","title":"ShopEngine \u003c 4.9.3 - Customer PII Disclosure via Forced Authentication","description":"The ShopEngine Elementor WooCommerce Builder Addon  WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.","status":"published","published":"2026-08-13T06:00:13.979Z","modified":"2026-08-13T14:14:33.37Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-57729","description":"The ShopEngine Elementor WooCommerce Builder Addon  WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.","status":"published","published":"2026-08-13T06:00:13Z","modified":"2026-08-13T14:14:33Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-mhv4-gprf-7m48","title":"The ShopEngine Elementor WooCommerce Builder Addon  WordPress plugin before 4.9.3 does not...","description":"The ShopEngine Elementor WooCommerce Builder Addon  WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.","status":"published","published":"2026-08-13T06:33:50Z","modified":"2026-08-13T15:35:36Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:10:25.845105Z"}],"nvd":[{"id":"CVE-2026-19088","description":"The ShopEngine Elementor WooCommerce Builder Addon  WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.","status":"published","published":"2026-08-13T06:17:38.23Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:37.217486Z"}]}}