The Shipo WordPress plugin versions 1.6 through 1.8.0 contain an authentication bypass vulnerability. This flaw arises because the plugin's authenticate_rest_user() function improperly trusts the LOGGED_IN_COOKIE value without verifying its cryptographic signature. Attackers can bypass intended route restrictions and impersonate any user, including administrators, via the REST API, enabling unauthorized actions such as creating new administrator accounts.