CVE-2026-19088 Overview
CVE-2026-19088 affects the ShopEngine Elementor WooCommerce Builder Addon WordPress plugin in versions prior to 4.9.3. The plugin fails to protect one of its authentication endpoints against Cross-Site Request Forgery (CSRF). An attacker can trick a victim into logging into an attacker-controlled account. When the victim proceeds to checkout, the billing and shipping details they enter are stored under the attacker's account and become readable by the attacker.
Critical Impact
Attackers can harvest victim billing and shipping data submitted at WooCommerce checkout by forcing authentication into an account the attacker controls.
Affected Products
- ShopEngine Elementor WooCommerce Builder Addon WordPress plugin versions before 4.9.3
- WordPress sites running WooCommerce with the vulnerable ShopEngine plugin
- Any WordPress e-commerce site that exposes the affected authentication endpoint to authenticated or unauthenticated visitors
Discovery Timeline
- 2026-08-13 - CVE-2026-19088 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-19088
Vulnerability Analysis
The flaw is a Cross-Site Request Forgery [CWE-352] weakness in one of ShopEngine's authentication endpoints. The endpoint does not validate a CSRF token or verify request origin before processing a login action. An attacker who hosts a malicious page can craft a request that, when loaded by a visiting victim, authenticates the victim's browser into an account the attacker controls. The victim then continues their shopping session unaware that their session belongs to an attacker's account.
When the victim completes checkout on the compromised session, WooCommerce persists the billing and shipping information against the attacker-owned account. The attacker can subsequently log into that account and read the stored personal and address data, resulting in disclosure of Personally Identifiable Information (PII) submitted during the purchase flow.
Root Cause
The root cause is missing anti-CSRF protection on an authentication endpoint exposed by the ShopEngine plugin. WordPress provides nonce APIs (wp_create_nonce, check_ajax_referer) intended to bind sensitive state-changing requests to the originating session. The affected endpoint in versions before 4.9.3 does not enforce such a check, so any cross-origin request that supplies valid credentials or a login payload is processed.
Attack Vector
Exploitation requires user interaction. The attacker lures a victim to a malicious or compromised page that auto-submits a login request to the vulnerable ShopEngine endpoint. The victim's browser is silently logged into the attacker's account. The victim then proceeds to purchase items, entering billing and shipping details that are stored on the attacker-controlled account. See the WPScan Vulnerability Report for further technical context.
Detection Methods for CVE-2026-19088
Indicators of Compromise
- Unexpected wp_login or WooCommerce session cookies being set immediately after a user visits an external site
- Checkout orders associated with accounts whose registration email does not match the customer's contact email
- Repeated logins to the same customer account from a wide range of unrelated client IP addresses
Detection Strategies
- Review WordPress and WooCommerce logs for authentication events originating from cross-site Referer headers pointing to untrusted domains
- Correlate order placement events with the account owner's historical login IPs to flag account/session mismatches
- Monitor for POST requests to the ShopEngine authentication endpoint that lack an expected nonce parameter
Monitoring Recommendations
- Enable verbose logging on the WooCommerce checkout and login flows and ship events to a centralized log platform
- Alert on customer support tickets reporting "order placed under wrong account" or "cannot see my recent order"
- Track the installed version of ShopEngine across all WordPress instances and alert on any host running a version below 4.9.3
How to Mitigate CVE-2026-19088
Immediate Actions Required
- Update the ShopEngine Elementor WooCommerce Builder Addon plugin to version 4.9.3 or later on all WordPress installations
- Invalidate active WooCommerce customer sessions and force re-authentication after patching
- Audit recent orders for account-ownership anomalies and notify affected customers if PII exposure is suspected
Patch Information
The vendor has addressed the CSRF issue in ShopEngine version 4.9.3. Site administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily deactivate the ShopEngine plugin until the upgrade to 4.9.3 can be validated in staging
- Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST requests to the ShopEngine authentication endpoint when the Referer or Origin header is absent or off-domain
- Enforce SameSite=Lax or SameSite=Strict on WordPress authentication cookies to reduce cross-site login abuse
# Example WP-CLI command to upgrade the plugin to the fixed version
wp plugin update shopengine --version=4.9.3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
