CVE-2026-123697: high-severity vulnerability in Security For WooCommerce
Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 0.3%
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Security For WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Security For WooCommerce
In the same product, most dangerous first.
CVE-2026-123695CRITICALSecurity For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token DisclosureEPSS 0.4%CVE-2026-100109CRITICALSecurity For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userEPSS 0.4%CVE-2026-123696HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication ResetEPSS 0.3%CVE-2026-123701MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings ResetEPSS 0.3%CVE-2026-123703MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logoutEPSS 0.3%CVE-2026-123700HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment DeletionEPSS 0.3%