CVE-2026-14919 is an improper authentication vulnerability (CWE-287) in the ShopMonitor.io WordPress plugin prior to version 1.2.0. The plugin's email-rerouting test mode is gated behind a trusted-source check that can be bypassed using client-supplied request headers. This allows unauthenticated attackers to redirect outgoing emails, including critical administrator password-reset emails, to an attacker-controlled address, enabling them to take over the administrator account.

Successful exploitation allows unauthenticated attackers to intercept administrator password-reset emails by redirecting them to an attacker-controlled address. This leads to full compromise of the WordPress administrator account, resulting in complete site takeover with confidentiality, integrity, and availability impacts rated as high.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is released, consider disabling the email-rerouting test mode or restricting access to trusted networks to mitigate exploitation risk.