CVE-2026-100109: critical vulnerability in Security For WooCommerce
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.4%
from disclosure to weapon1 day
Published on NVDNov 5
1st PoC+1d
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Security For WooCommercepublic PoCs found — 2
githubgithub.com/thiscitze/cve-2026-100109-poc★ 0cve_referencewpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.