CVE-2026-123695: critical vulnerability in Security For WooCommerce
Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.4%
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Security For WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/ad945f05-fc7e-4dad-8a37-b9a6a7acf7e0/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Security For WooCommerce
In the same product, most dangerous first.
CVE-2026-100109CRITICALSecurity For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userEPSS 0.4%CVE-2026-123696HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication ResetEPSS 0.3%CVE-2026-123701MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings ResetEPSS 0.3%CVE-2026-123703MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logoutEPSS 0.3%CVE-2026-123700HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment DeletionEPSS 0.3%CVE-2026-123705MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Server Configuration Information DisclosureEPSS 0.3%