CVE-2026-19088

Name of the Vulnerable Software and Affected Versions ShopEngine Elementor WooCommerce Builder Addon versions prior to 4.9.3

Description An authentication endpoint is not protected against Cross-Site Request Forgery (CSRF), a type of attack that forces an authenticated user to execute unwanted actions on a web application. This flaw allows an attacker to log a victim into an account controlled by the attacker. Consequently, any billing and shipping details the victim enters during the checkout process are stored under and can be read by the attacker.

Recommendations Update ShopEngine Elementor WooCommerce Builder Addon to version 4.9.3 or later.