{"id":"CVE-2026-123695","kind":"vulnerability","aliases":["CVE-2026-123695"],"related":[],"title":"WordPress WooCommerce security plugin: unauthenticated REST routes let attackers log in as admins","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.","summary":"The Security For WooCommerce WordPress plugin through version 1.0.16 exposes several REST API routes without access checks. An unauthenticated attacker can generate login tokens for any user, including administrators, and then retrieve them to log in as that user.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ultimate-security-for-woocommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["no-fix","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: look for 'Security For WooCommerce' (slug ultimate-security-for-woocommerce, author Rizvi / rizvipersonal), or run: wp plugin list --name=ultimate-security-for-woocommerce\n- Any installed version up to 1.0.16 is affected; no later version is known.","fix":"No fixed version known. The researcher says no fix is available and Wordfence lists the sibling issue as Unpatched with the plugin Removed from WordPress.org. Deactivate and delete the plugin, then replace it with a maintained security plugin. If it was active on an internet-facing site, review admin accounts, sessions and recent logins, and rotate admin passwords and the wp-config salts.","status":"open","published_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:20+00:00","updated_at":"2026-11-11T06:28:53+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-11T06:27:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce security plugin: unauthenticated REST routes let attackers log in as admins","impact":"high","summary":"The Security For WooCommerce WordPress plugin through version 1.0.16 exposes several REST API routes without access checks. An unauthenticated attacker can generate login tokens for any user, including administrators, and then retrieve them to log in as that user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any admin and takes over the site","analyst_note":"Find the plugin's changelog or WordPress.org page to confirm a fixed version and whether a patch was released.","how_to_check":"- Check whether the `Security For WooCommerce` plugin is installed and its version in the WordPress admin under Plugins\n- Confirm the installed version is `1.0.16` or earlier\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the Security For WooCommerce plugin at version 1.0.16 or earlier is exposed, because the REST routes accept unauthenticated requests. Sites without this plugin, or running a later version, are not affected according to the description. The sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000722,"input_tokens":4529,"output_tokens":539,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the plugin's changelog or WordPress.org page to confirm a fixed version and whether a patch was released.","search":"'-123695':16A,19A '-2026':15A,18A '1.0.16':42B,80C 'access':49B,84C 'admin':13A 'administr':62B,114C 'allow':92C 'api':46B,90C 'attack':9A,53B 'check':50B 'cve':14A,17A 'everi':100C 'expos':43B 'fix':27B 'for':23A 'generat':55B,96C 'host':31B 'includ':61B,113C 'let':8A 'log':10A,68B,108C 'login':56B,97C 'no-fix':25B 'packag':28B 'plugin':4A,39B,78C 'rest':6A,45B,89C 'restrict':83C 'retriev':65B,104C 'rout':7A,47B,91C 'secur':3A,35B,74C 'security':22A 'self':30B 'self-host':29B 'sever':44B,86C 'token':57B,98C 'ultimate':21A 'ultimate-security-for-woocommerce':20A 'unauthent':5A,52B,93C 'user':60B,72B,94C,101C,112C 'version':41B 'without':48B 'woocommerc':2A,32B,37B,76C 'woocommerce':24A 'wordpress':1A,33B,38B,77C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress/WooCommerce site running the Security For WooCommerce plugin (slug ultimate-security-for-woocommerce) at 1.0.16 or earlier is exposed: its REST routes need no login, so a visitor can mint a login token for any user, admins included. The plugin is small (about 2,700 downloads per Wordfence) and has been removed from WordPress.org. Sites without it can skip this. Note this is a different product from the commercial 'Security for WooCommerce' by OPMC on woocommerce.com.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ultimatesecurityforwoocommerce"],"ptokens":["for","security","ultimate","woocommerce"],"labels":["critical","nofix","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123695':16A,19A '-2026':15A,18A 'admin':13A 'attack':9A 'cve':14A,17A 'for':23A 'let':8A 'log':10A 'plugin':4A 'rest':6A 'rout':7A 'secur':3A 'security':22A 'ultimate':21A 'ultimate-security-for-woocommerce':20A 'unauthent':5A 'woocommerc':2A 'woocommerce':24A 'wordpress':1A","search_b":"'1.0.16':42B 'access':49B 'administr':62B 'api':46B 'attack':53B 'check':50B 'expos':43B 'fix':27B 'generat':55B 'host':31B 'includ':61B 'log':68B 'login':56B 'no-fix':25B 'packag':28B 'plugin':39B 'rest':45B 'retriev':65B 'rout':47B 'secur':35B 'self':30B 'self-host':29B 'sever':44B 'token':57B 'unauthent':52B 'user':60B,72B 'version':41B 'without':48B 'woocommerc':32B,37B 'wordpress':33B,38B","search_c":"'1.0.16':80C 'access':84C 'administr':114C 'allow':92C 'api':90C 'everi':100C 'generat':96C 'includ':113C 'log':108C 'login':97C 'plugin':78C 'rest':89C 'restrict':83C 'retriev':104C 'rout':91C 'secur':74C 'sever':86C 'token':98C 'unauthent':93C 'user':94C,101C,112C 'woocommerc':76C 'wordpress':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123695","severity":null,"published_at":"2026-11-11T06:17:18+00:00","modified_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123695:3504","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-security-for-woocommerce","severity":null,"published_at":"2026-11-11T06:28:53+00:00","modified_at":"2026-11-11T06:28:53+00:00","first_seen_at":"2026-11-11T06:28:53+00:00","fetched_at":"2026-11-11T06:28:53+00:00","note":"NVD text only plus third-party sources: researcher (dev.to) says no fix for <=1.0.16; Wordfence says plugin Removed, sibling CVE-2026-100109 Unpatched. No vendor advisory found; nothing marked verified. Siblings CVE-2026-123696..123705 and CVE-2026-100109 are the same plugin. No exploitation or PoC seen.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-security-for-woocommerce","https://wordpress.org/plugins/ultimate-security-for-woocommerce/"]}],"documents":[{"id":123290,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-security-for-woocommerce","title":"Wordfence: Security For WooCommerce (ultimate-security-for-woocommerce) – status Removed, vulnerability Unpatched","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":123288,"url":"https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8","title":"10 wordpress plugin vulns i reported are public","kind":"blog","source":"analyst","publisher":null,"text":"Researcher post: wpscan published 10 unauthenticated vulnerabilities in security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. No fix is available.","published_at":"2026-11-09T00:00:00+00:00","relation":"discussion","confidence":null,"note":null},{"id":74622,"url":"https://wordpress.org/plugins/ultimate-security-for-woocommerce/","title":"Security For WooCommerce – WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}