CVE-2026-19088 — ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log …
Published: 2026-08-13 · CVSS: 5.4 · CVSS 3.1
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7