The ShopMonitor.io WordPress plugin version prior to 1.2.0 contains a flaw that allows an unauthenticated attacker to manipulate request headers and invoke a test mode email‑rerouting function. By redirecting the password‑reset email to an address controlled by the attacker, the adversary can gain control of the WordPress administrator account without needing valid credentials. This privilege escalation results in full administrative access to the site.

WordPress sites running the ShopMonitor.io plugin before version 1.2.0. The vendor is listed as Unknown:ShopMonitor.io. Any installation of the plugin that has not migrated to 1.2.0 or later is vulnerable.

The vulnerability’s CVSS score of 9.8 signals critical severity, indicating that an attacker can fully compromise an administrator account. The EPSS score is below 1%, suggesting a low current exploitation probability, but the combination of an easy‑to‑exploit HTTP request and the high severity means the risk remains significant. Exploitation requires only the ability to craft request headers to trigger the plugin’s email‑rerouting test mode; no authentication is needed. Once the password‑reset email is redirected to an attacker‑controlled address, the attacker can reset the administrator password and gain full site control. The vulnerability is not listed in CISA’s KEV catalog, but the severe impact warrants immediate attention.