{"id":"CVE-2026-100109","kind":"vulnerability","aliases":["CVE-2026-100109"],"related":[],"title":"WooCommerce security plugin: unauthenticated users can create administrator accounts","description":"The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.","summary":"The Security For WooCommerce WordPress plugin (slug ultimate-security-for-woocommerce, by Rizvi) 1.0.10 through 1.0.16 has a user-creation action open to visitors who are not logged in, and the caller picks the role. An attacker can create an administrator account and take over the site. No fix has been found.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"security-for-woocommerce","fixed":[],"affected":">= 1.0.10, <= 1.0.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","privilege-escalation","security-for-woocommerce","unauthenticated","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-outside-1.0.10-1.0.16"],"how_to_check":"- In WordPress admin > Plugins, look for 'Security For WooCommerce' (folder ultimate-security-for-woocommerce, author Rizvi); versions 1.0.10 to 1.0.16 are affected.\n- Review Users for unexpected administrator accounts or recent temporary users.\n- Check access logs for unauthenticated admin-ajax.php requests with action usfw_create_temporary_user (action name from a secondary source).","fix":"No fixed version published as of 2026-11-05; the wordpress.org page lists 1.0.15 as current and the changelog has no security fix. Deactivate and delete the plugin.","status":"open","published_at":"2026-11-05T08:17:01+00:00","first_seen_at":"2026-11-05T08:38:02+00:00","triaged_at":"2026-11-05T08:39:51+00:00","updated_at":"2026-11-05T08:41:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T08:39:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Security For WooCommerce plugin to a version later than `1.0.16`; the sources do not name the exact fixed version.","reach":"internet","title":"WooCommerce security plugin: unauthenticated users can create administrator accounts","impact":"high","summary":"The Security For WooCommerce WordPress plugin, versions 1.0.10 through 1.0.16, lets anyone without a login create new user accounts and choose their role. An attacker can create an administrator account and take over the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","security-for-woocommerce"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker creates an administrator account and takes over the site.","analyst_note":"Confirm the fixed version from the plugin's vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-100109.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or inspect the plugin header in `wp-content/plugins/` for the Security For WooCommerce plugin.\n- Review the users list for unexpected accounts with the administrator role.\n- unknown for any other check, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-outside-1.0.10-1.0.16"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin between versions 1.0.10 and 1.0.16 are exposed, because the user-creation action is open to visitors who are not logged in. Sites without this plugin or running versions outside that range are not affected by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000743,"input_tokens":4233,"output_tokens":639,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the plugin's vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-100109.","search":"'-100109':12A,15A '-2026':11A,14A '1.0.10':45B,92C '1.0.16':47B,94C 'account':9A,74B,117C,126C 'action':53B,105C 'administr':8A,73B,125C 'allow':120C 'attack':69B,122C 'avail':106C 'caller':64B,113C 'capabl':98C 'check':99C 'choos':114C 'creat':7A,71B,101C,124C 'creation':52B 'cve':10A,13A 'escal':23B 'fix':81B 'for':18A 'found':84B 'let':111C 'log':60B 'new':116C 'open':54B 'packag':20B 'perform':97C 'pick':65B 'plugin':3A,36B,90C 'privileg':22B 'privilege-escal':21B 'rizvi':44B 'role':67B,119C 'secur':2A,25B,32B,40B,86C 'security':17A 'security-for-woocommerc':24B 'security-for-woocommerce':16A 'site':79B,131C 'slug':37B 'take':76B,128C 'ultim':39B 'ultimate-security-for-woocommerc':38B 'unauthent':4A,28B,108C,121C 'user':5A,51B,102C 'user-cr':50B 'visitor':56B,109C 'woocommerc':1A,27B,29B,34B,42B,88C 'woocommerce':19A 'wordpress':30B,35B,89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security For WooCommerce WordPress plugin between versions 1.0.10 and 1.0.16 are exposed, because the user-creation action is open to visitors who are not logged in. Sites without this plugin or running versions outside that range are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["securityforwoocommerce"],"ptokens":["for","security","woocommerce"],"labels":["critical","package","privilegeescalation","securityforwoocommerce","unauthenticated","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T08:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100109","severity":null,"published_at":"2026-11-05T08:17:01+00:00","modified_at":"2026-11-05T08:17:01+00:00","first_seen_at":"2026-11-05T08:38:02+00:00","fetched_at":"2026-11-05T08:38:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-100109:1766","url":"https://wordpress.org/plugins/ultimate-security-for-woocommerce/","severity":null,"published_at":"2026-11-05T08:41:40+00:00","modified_at":"2026-11-05T08:41:40+00:00","first_seen_at":"2026-11-05T08:41:40+00:00","fetched_at":"2026-11-05T08:41:40+00:00","note":"NVD/WPScan CNA: Security For WooCommerce 1.0.10-1.0.16 unauth user creation (usfw_create_temporary_user per HOL Guard, secondary). Plugin is slug ultimate-security-for-woocommerce by Rizvi, <10 installs, wp.org page lists 1.0.15, changelog has no fix, not updated in ~10 months. No fixed version found; not verified (no vendor advisory). No exploitation or PoC found.","cites":["https://wordpress.org/plugins/ultimate-security-for-woocommerce/","https://nvd.nist.gov/vuln/detail/CVE-2026-100109"]}],"documents":[{"id":74622,"url":"https://wordpress.org/plugins/ultimate-security-for-woocommerce/","title":"Security For WooCommerce (wordpress.org plugin page)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":74623,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100109","title":"NVD CVE-2026-100109","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}