CVE-2026-19088

5.4 Moyenne

Publiée le 13/08/2026 à 08:17 · Modifiée le 26/08/2026 à 18:30 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

Traduire en français

Produits concernés

Unknown ShopEngine Elementor WooCommerce Builder Addon

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-352

Références

https://wpscan.com/vulnerability/f58066e9-8066-43bc-8778-7ded279e8ee2/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories