{"metadata": {"vulnerability": "CVE-2026-19907", "count": 14, "kinds": {"milestone": 3, "sighting": 6, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-14T19:56:29.273Z", "date_only": false, "value": "2026-08-14T19:56:29.273Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19907", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-14T00:33:13Z", "date_only": false, "value": "2026-11-14T00:33:13.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19907", "field": "containers.cna.timeline.0.time", "text": "Disclosed"}, {"timestamp": "2026-11-14T12:33:23.699Z", "date_only": false, "value": "2026-11-14T12:33:23.699Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19907", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-14T12:33:23.699Z", "date_only": false, "value": "2026-11-14T12:33:23.699Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19907", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-14T12:33:23.699Z", "date_only": false, "value": "2026-11-14T12:33:23.699Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19907", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-14T12:43:43.735Z", "date_only": false, "value": "2026-11-14T12:43:43.735926Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117614852381152216", "record": "CVE-2026-19907", "field": "creation_timestamp", "uuid": "4c22b3f3-a731-46ab-a7f0-75d35394e789", "content": "CVE-2026-19907 Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's cryptographic signature. The function's intended `/wp-json/shipo/` route restriction can also be bypassed by placing that substring in the query string of an unrelated REST endpoint. This makes it possible for unauthenticated attackers who know an existing username to impersonate that user, including an administrator, and perform authorized actions through the REST API, including creating another administrator account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-19907https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5ea515-5ae1-4771-9bfb-5a0f4b3fce22?source=cvehttps://plugins.trac.wordpress.org/changeset/3701532/shipo#wordpress #shipo #Shipo#CVE_2026_19907#bot", "url": "https://infosec.exchange/users/cve/statuses/117614852381152216"}, {"timestamp": "2026-11-14T13:17:23Z", "date_only": false, "value": "2026-11-14T13:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8269-9P52-9CVV", "record": "GHSA-8269-9P52-9CVV", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-14T13:30:40.362Z", "date_only": false, "value": "2026-11-14T13:30:40.362804Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117615036959810731", "record": "cve-2026-19907", "field": "creation_timestamp", "uuid": "650f794a-115d-4b95-adab-6aad27366019", "content": "CVE-2026-19907: CRITICAL (CVSS 9.8) auth bypass in Shipo WP plugin v1.6 \u2013 1.8.0. Unauthenticated attackers can impersonate admins & gain full site control. Disable affected versions ASAP. More: https://radar.offseq.com/threat/cve-2026-19907-cwe-287-improper-authentication-in-shipo-shipo-924d020ff101b91a #OffSeq #WordPress #CVE202619907 #Infosec", "url": "https://infosec.exchange/users/offseq/statuses/117615036959810731"}, {"timestamp": "2026-11-14T13:30:42.150Z", "date_only": false, "value": "2026-11-14T13:30:42.150951Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3n2bmakqrgu2n", "record": "cve-2026-19907", "field": "creation_timestamp", "uuid": "8a892240-f08d-4789-a7a7-3da6f967a9ef", "content": "Shipo WordPress plugin v1.6 \u2013 1.8.0 hit by CRITICAL (CVSS 9.8) auth bypass. Attackers can impersonate admins & take control. Disable plugin now and monitor for fixes. https://radar.offseq.com/threat/cve-2026-19907-cwe-287-improper-authentication-in-shipo-shipo-924d020ff101b91a #OffSeq #WordPress ...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3n2bmakqrgu2n"}, {"timestamp": "2026-11-14T13:40:06.724Z", "date_only": false, "value": "2026-11-14T13:40:06.724508Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n2bmrfhj3d25", "record": "CVE-2026-19907", "field": "creation_timestamp", "uuid": "ed6538d1-5ef5-46c0-9279-66a1074d6d8c", "content": "CVE-2026-19907 - shipo\nThe Shipo add\u2011on for WordPress (versions 1.6 through 1.8.0) fails to properly check login cookies, so someone who knows a valid username can pretend to be that user, including the site\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#shipo #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n2bmrfhj3d25"}, {"timestamp": "2026-11-14T14:55:56.231Z", "date_only": false, "value": "2026-11-14T14:55:56.231914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2ecn3hlgfrfko", "record": "CVE-2026-19907", "field": "creation_timestamp", "uuid": "9a7af6c0-e51c-49df-834f-5e7911755c8c", "content": "CVE-2026-19907 - Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator\nCVE ID : CVE-2026-19907\n \n Published : Nov. 14, 2026, 1:17 p.m. | 57\u00a0minutes ago\n \n Description : The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. Th...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/2ecn3hlgfrfko"}, {"timestamp": "2026-11-14T15:31:45Z", "date_only": false, "value": "2026-11-14T15:31:45Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8269-9P52-9CVV", "record": "GHSA-8269-9P52-9CVV", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-14T15:31:45Z", "date_only": false, "value": "2026-11-14T15:31:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8269-9P52-9CVV", "record": "GHSA-8269-9P52-9CVV", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-14T16:47:30.432Z", "date_only": false, "value": "2026-11-14T16:47:30.432021Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n2etgrbv4mw3", "record": "cve-2026-19907", "field": "creation_timestamp", "uuid": "def078b0-1b18-423b-95a2-68b031cc3dd0", "content": "Developing: Critical Shipo Vulnerability (CVE-2026-19907)\nhttps://cyber.eventmonitor.net/incident/EM-20261114-X6YP/critical-shipo-vulnerability-cve-2026-19907/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n2etgrbv4mw3"}], "metrics": {"as_of": "2026-11-14T17:59:10.009Z", "anchors": {"origin": {"timestamp": "2026-11-14T12:33:23.699Z", "date_only": false, "value": "2026-11-14T12:33:23.699Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19907", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-14T12:33:23.699Z", "date_only": false, "value": "2026-11-14T12:33:23.699Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19907", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 19546.310777, "hours": 5.4295307713888885, "days": 0.22623044880787035, "min_seconds": 19546.310777, "max_seconds": 19546.310777, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-14T12:33:23.699Z", "date_only": false, "value": "2026-11-14T12:33:23.699Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19907", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T17:59:10.009Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}