CVE-2026-123699: fallo de gravedad media en Security For WooCommerce
Security For WooCommerce <= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core Updates
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 4.8epss 0.2%
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Productos afectados
Unknown · Security For WooCommercePoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Security For WooCommerce
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-123695CRITICALSecurity For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token DisclosureEPSS 0.4%CVE-2026-100109CRITICALSecurity For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userEPSS 0.4%CVE-2026-123696HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication ResetEPSS 0.3%CVE-2026-123701MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings ResetEPSS 0.3%CVE-2026-123703MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logoutEPSS 0.3%CVE-2026-123700HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment DeletionEPSS 0.3%