CVE-2026-19088 - ShopEngine 4.9.3 - Customer PII Disclosure via Forced Authentication
Brief
CVE ID : CVE-2026-19088
Published : Aug. 13, 2026, 6:17 a. m.
- 2 hours, 47 minutes ago
Description : The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.
- 3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...