CVE-2026-123701: falha de média gravidade em Security For WooCommerce
Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Reset
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.3%
The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · Security For WooCommercePoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Security For WooCommerce
No mesmo produto, das mais perigosas para as menos.
CVE-2026-123695CRITICALSecurity For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token DisclosureEPSS 0.4%CVE-2026-100109CRITICALSecurity For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userEPSS 0.4%CVE-2026-123696HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication ResetEPSS 0.3%CVE-2026-123703MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logoutEPSS 0.3%CVE-2026-123700HIGHSecurity For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment DeletionEPSS 0.3%CVE-2026-123705MEDIUMSecurity For WooCommerce <= 1.0.16 - Unauthenticated Server Configuration Information DisclosureEPSS 0.3%