ShopMonitor.io – Automated Checkout & Form Monitoring
ShopMonitor.io – Automated Checkout & Form Monitoring has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Unverified Password Change, behind 1 of the records (100%).
The one issue recorded for ShopMonitor.io – Automated Checkout & Form Monitoring has a vendor fix available, so running the current release closes it.
All of these findings were reported by Pedro Pinho. ShopMonitor.io – Automated Checkout & Form Monitoring is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2026-14919ShopMonitor.io – Automated Checkout & Form Monitoring < 1.2.0 - Unauthenticated Privilege Escalation via Account Takeover
Read the full analysisVulnerability Records

ShopMonitor.io – Automated Checkout & Form Monitoring
Author
Winning Solutions
ShopMonitor.io monitors your websites from the outside – simulating real customer behaviour to catch issues before your customers do. This plugin connects your WordPress site to the ShopMonitor.io service and shows the connection status, detected integrations, and monitoring links directly in your WordPress admin. Key Features Connection Status: See at a glance whether your site is connected to ShopMonitor.io — right from the WordPress admin and dashboard widget WooCommerce Checkout Monitoring: Automated end-to-end tests for add-to-cart flows and the full checkout process, including both classic and block-based checkouts Contact Form Testing: Automatically test form submissions and verify that emails are delivered — supports Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable Forms, Forminator, and WS Form Login Flow Monitoring: Automated checks for your WordPress login area Form tests: track whether confirmation emails were successfully sent during ShopMonitor test runs and report the result via the monitoring API Form Integration Detection: The plugin detects which form plugins are active and shows their names so ShopMonitor knows what to test Direct Links: Quick links to the ShopMonitor.io web app to view monitoring runs, history, and results Spam & Captcha Bypass: Automatically bypasses spam protection and captcha checks (e.g. Cloudflare Turnstile, hCaptcha, CleanTalk, reCAPTCHA) during ShopMonitor test runs, so automated tests are not blocked Benefits Catch Issues Early: Know about broken checkouts, failed form submissions, or login problems before your customers do Peace of Mind: Continuous automated monitoring means you always know your shop is working No Manual Testing: Stop clicking through your own checkout to verify it works — ShopMonitor does it for you Easy Setup: No API key required in WordPress — just install, activate, and connect via the ShopMonitor.io web app How It Works Install and activate the plugin Log in to ShopMonitor.io and add your website The plugin shows Connected status in your WordPress admin once the connection is established ShopMonitor.io runs automated test flows at your configured intervals View all monitoring runs, results, and alerts in the ShopMonitor.io web app Supported Integrations Form Plugins: Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable Forms, Forminator, WS Form Spam & Security Plugins: CleanTalk, Solid Security, All-In-One WP Security, Wordfence, Defender Pro, Simple Cloudflare Turnstile, hCaptcha WooCommerce Captcha Plugins: Enhanced Turnstile for WooCommerce, Koala reCAPTCHA for WooCommerce, reCAPTCHA for WooCommerce by i13 Privacy Policy This plugin displays connection and integration information in wp-admin. It does not transmit your WooCommerce catalog or customer data to ShopMonitor.io. During automated monitoring runs, ShopMonitor.io connects to your site from the outside and simulates customer actions (e.g. adding a product to cart or submitting a form). No personal customer data is collected or stored by the plugin as part of this process. External services This plugin connects to the ShopMonitor.io service to display connection status and to enable automated monitoring of your website. What data is sent and when: * The plugin may request the ShopMonitor.io public key from the configured API URL to verify inbound requests from the monitoring service * During automated test runs initiated by ShopMonitor.io, the service connects to your site and interacts with your store or forms as a real visitor would — no customer data from your store is sent outbound
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C