ULTIMATE-SECURITY-FOR-WOOCOMMERCE · CVE-2026-123695 · Package
NO FIX YET · SEE WHAT TO DO
The Security For WooCommerce WordPress plugin through version 1.0.16 exposes several REST API routes without access checks. An unauthenticated attacker can generate login tokens for any user, including administrators, and then retrieve them to log in as that user.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress/WooCommerce site running the Security For WooCommerce plugin (slug ultimate-security-for-woocommerce) at 1.0.16 or earlier is exposed: its REST routes need no login, so a visitor can mint a login token for any user, admins included. The plugin is small (about 2,700 downloads per Wordfence) and has been removed from WordPress.org. Sites without it can skip this. Note this is a different product from the commercial 'Security for WooCommerce' by OPMC on woocommerce.com.
Not affected if plugin-not-installed
Who cares no-fix, self-hosted, woocommerce, wordpress
Posts are quoted with a link to the original. They are data to us, never instructions.
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.