---
id: "CVE-2026-123695"
page: "https://infrastack.ai/live/CVE-2026-123695"
kind: "vulnerability"
aliases: ["CVE-2026-123695"]
title: "WordPress WooCommerce security plugin: unauthenticated REST routes let attackers log in as admins"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ultimate-security-for-woocommerce", "fixed": [], "affected": "<= 1.0.16", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["no-fix", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:18+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:28:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123695", "first_seen_at": "2026-11-11T06:25:43+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-security-for-woocommerce", "first_seen_at": "2026-11-11T06:28:53+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-security-for-woocommerce", "https://wordpress.org/plugins/ultimate-security-for-woocommerce/"]}]
exploit_sources: []
---

# WordPress WooCommerce security plugin: unauthenticated REST routes let attackers log in as admins

Link for people: https://infrastack.ai/live/CVE-2026-123695 (this .md is for agents)

The Security For WooCommerce WordPress plugin through version 1.0.16 exposes several REST API routes without access checks. An unauthenticated attacker can generate login tokens for any user, including administrators, and then retrieve them to log in as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ultimate-security-for-woocommerce affected <= 1.0.16 fixed no fixed version listed

## How to check

- WordPress admin > Plugins: look for 'Security For WooCommerce' (slug ultimate-security-for-woocommerce, author Rizvi / rizvipersonal), or run: wp plugin list --name=ultimate-security-for-woocommerce
- Any installed version up to 1.0.16 is affected; no later version is known.

## Fix

No fixed version known. The researcher says no fix is available and Wordfence lists the sibling issue as Unpatched with the plugin Removed from WordPress.org. Deactivate and delete the plugin, then replace it with a maintained security plugin. If it was active on an internet-facing site, review admin accounts, sessions and recent logins, and rotate admin passwords and the wp-config salts.

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123695
- 2026-11-11T06:28:53+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-security-for-woocommerce — NVD text only plus third-party sources: researcher (dev.to) says no fix for <=1.0.16; Wordfence says plugin Removed, sibling CVE-2026-100109 Unpatched. No vendor advisory found; nothing marked verified. Siblings CVE-2026-123696..123705 and CVE-2026-100109 are the same plugin. No exploitation or PoC seen.

## Documents

- [describes] Wordfence: Security For WooCommerce (ultimate-security-for-woocommerce) – status Removed, vulnerability Unpatched https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-security-for-woocommerce
- [describes] Security For WooCommerce – WordPress.org plugin page https://wordpress.org/plugins/ultimate-security-for-woocommerce/
- [discussion] 10 wordpress plugin vulns i reported are public https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_