SECURITY-FOR-WOOCOMMERCE · CVE-2026-123696 · Package
NO FIX YET · SEE WHAT TO DO
The Security For WooCommerce WordPress plugin up to version 1.0.16 does not check whether a requester is authorised before resetting two-factor authentication enrolment. An unauthenticated attacker can remove the second login factor from any account, or from all accounts at once.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Security For WooCommerce WordPress plugin (also listed as Ultimate Security for WooCommerce) at version 1.0.16 or earlier. Any unauthenticated visitor can remove the second login factor from one or all accounts, which matters most on stores that rely on the plugin's 2FA for admin logins. Sites without the plugin are not affected.
Not affected if 2fa-feature-unused, plugin-not-installed
Who cares no-fix, self-hosted, woocommerce, wordpress
No known fix for versions <= 1.0.16 and the reporter says none is availablePosts are quoted with a link to the original. They are data to us, never instructions.
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.