CVE-2026-123695
Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.
| Vendor | unknown |
| Product | security for woocommerce |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown security for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown security for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Security For WooCommerce
0 ≤ 1.0.16
References
Credits
Aabideen Bangash WPScan