---
id: "CVE-2026-100109"
kind: "vulnerability"
aliases: ["CVE-2026-100109"]
title: "WooCommerce security plugin: unauthenticated users can create administrator accounts"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "security-for-woocommerce", "fixed": [], "affected": ">= 1.0.10, <= 1.0.16", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "privilege-escalation", "security-for-woocommerce", "unauthenticated", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-outside-1.0.10-1.0.16"]
published_at: "2026-11-05T08:17:01+00:00"
first_seen_at: "2026-11-05T08:38:02+00:00"
updated_at: "2026-11-05T08:41:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100109", "first_seen_at": "2026-11-05T08:38:02+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100109", "first_seen_at": "2026-11-05T08:41:40+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-100109", "https://wordpress.org/plugins/ultimate-security-for-woocommerce/"]}]
exploit_sources: []
---

# WooCommerce security plugin: unauthenticated users can create administrator accounts

The Security For WooCommerce WordPress plugin (slug ultimate-security-for-woocommerce, by Rizvi) 1.0.10 through 1.0.16 has a user-creation action open to visitors who are not logged in, and the caller picks the role. An attacker can create an administrator account and take over the site. No fix has been found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:security-for-woocommerce affected >= 1.0.10, <= 1.0.16 fixed no fixed version listed

## How to check

- In WordPress admin > Plugins, look for 'Security For WooCommerce' (folder ultimate-security-for-woocommerce, author Rizvi); versions 1.0.10 to 1.0.16 are affected.
- Review Users for unexpected administrator accounts or recent temporary users.
- Check access logs for unauthenticated admin-ajax.php requests with action usfw_create_temporary_user (action name from a secondary source).

## Fix

No fixed version published as of 2026-11-05; the wordpress.org page lists 1.0.15 as current and the changelog has no security fix. Deactivate and delete the plugin.

## Timeline

- 2026-11-05T08:38:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100109
- 2026-11-05T08:41:40+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-100109 — NVD/WPScan CNA: Security For WooCommerce 1.0.10-1.0.16 unauth user creation (usfw_create_temporary_user per HOL Guard, secondary). Plugin is slug ultimate-security-for-woocommerce by Rizvi, <10 installs, wp.org page lists 1.0.15, changelog has no fix, not updated in ~10 months. No fixed version found; not verified (no vendor advisory). No exploitation or PoC found.

## Documents

- [advisory] NVD CVE-2026-100109 https://nvd.nist.gov/vuln/detail/CVE-2026-100109
- [describes] Security For WooCommerce (wordpress.org plugin page) https://wordpress.org/plugins/ultimate-security-for-woocommerce/

## From the sources

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_