{"id":"CVE-2026-123696","kind":"vulnerability","aliases":["CVE-2026-123696"],"related":[],"title":"WordPress Security for WooCommerce plugin lets anyone reset two-factor login","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.","summary":"The Security For WooCommerce WordPress plugin up to version 1.0.16 does not check whether a requester is authorised before resetting two-factor authentication enrolment. An unauthenticated attacker can remove the second login factor from any account, or from all accounts at once.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"security-for-woocommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["no-fix","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["2fa-feature-unused","plugin-not-installed"],"how_to_check":"- Run wp plugin get security-for-woocommerce --field=version, or look under Plugins in wp-admin. Any version up to and including 1.0.16 is exposed, and no newer version is known.\n- Also check for the plugin listed as 'Ultimate Security for WooCommerce'; the reporter names it as the same plugin.\n- If the plugin is installed and its 2FA is in use, assume 2FA enrolments may have been reset: review recent admin logins and 2FA settings.","fix":"No fixed version known as of 2026-11-11: WPScan lists 'No known fix' for versions <= 1.0.16 and the reporter says none is available. Not confirmed by the plugin author. Until one ships, deactivate and remove the plugin, or block its 2FA reset endpoint at the WAF.","status":"open","published_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:15+00:00","updated_at":"2026-11-11T06:29:57+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-11T06:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Security for WooCommerce plugin lets anyone reset two-factor login","impact":"medium","summary":"The Security For WooCommerce WordPress plugin up to version 1.0.16 does not check whether a requester is authorised before resetting two-factor authentication enrolment. An unauthenticated attacker can remove the second login factor from any account, or from all accounts at once.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attackers disable two-factor login on all accounts","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry lacks product ranges and a severity score.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get security-for-woocommerce --field=version`.\n- Treat any installed version up to and including `1.0.16` as exposed.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","2fa-feature-unused"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin at version 1.0.16 or earlier, most likely WooCommerce stores that enabled its two-factor feature. Sites without the plugin, or with it removed, are not affected. The sources do not state whether a fixed version exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4526,"output_tokens":577,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry lacks product ranges and a severity score.","search":"'-123696':15A,18A '-2026':14A,17A '1.0.16':41B,80C 'account':68B,72B,106C,110C 'allow':96C 'anyon':7A 'attack':59B 'authent':55B,94C 'authoris':49B,88C 'check':44B,83C 'cve':13A,16A 'enrol':56B,95C 'everi':109C 'factor':11A,54B,65B,93C,103C 'fix':25B 'for':21A 'host':29B 'let':6A 'login':12A,64B 'no-fix':23B 'packag':26B 'plugin':5A,37B,78C 'remov':61B,100C 'request':47B,86C 'reset':8A,51B,90C 'second':63B,102C 'secur':2A,33B,74C 'security':20A 'security-for-woocommerce':19A 'self':28B 'self-host':27B 'two':10A,53B,92C 'two-factor':9A,52B,91C 'unauthent':58B,97C 'user':98C 'version':40B 'whether':45B 'woocommerc':4A,30B,35B,76C 'woocommerce':22A 'wordpress':1A,31B,36B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security For WooCommerce WordPress plugin (also listed as Ultimate Security for WooCommerce) at version 1.0.16 or earlier. Any unauthenticated visitor can remove the second login factor from one or all accounts, which matters most on stores that rely on the plugin's 2FA for admin logins. Sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["securityforwoocommerce"],"ptokens":["for","security","woocommerce"],"labels":["high","nofix","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123696':15A,18A '-2026':14A,17A 'anyon':7A 'cve':13A,16A 'factor':11A 'for':21A 'let':6A 'login':12A 'plugin':5A 'reset':8A 'secur':2A 'security':20A 'security-for-woocommerce':19A 'two':10A 'two-factor':9A 'woocommerc':4A 'woocommerce':22A 'wordpress':1A","search_b":"'1.0.16':41B 'account':68B,72B 'attack':59B 'authent':55B 'authoris':49B 'check':44B 'enrol':56B 'factor':54B,65B 'fix':25B 'host':29B 'login':64B 'no-fix':23B 'packag':26B 'plugin':37B 'remov':61B 'request':47B 'reset':51B 'second':63B 'secur':33B 'self':28B 'self-host':27B 'two':53B 'two-factor':52B 'unauthent':58B 'version':40B 'whether':45B 'woocommerc':30B,35B 'wordpress':31B,36B","search_c":"'1.0.16':80C 'account':106C,110C 'allow':96C 'authent':94C 'authoris':88C 'check':83C 'enrol':95C 'everi':109C 'factor':93C,103C 'plugin':78C 'remov':100C 'request':86C 'reset':90C 'second':102C 'secur':74C 'two':92C 'two-factor':91C 'unauthent':97C 'user':98C 'woocommerc':76C 'wordpress':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123696","severity":null,"published_at":"2026-11-11T06:17:18+00:00","modified_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123696:3511","url":"https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d","severity":null,"published_at":"2026-11-11T06:29:57+00:00","modified_at":"2026-11-11T06:29:57+00:00","first_seen_at":"2026-11-11T06:29:57+00:00","fetched_at":"2026-11-11T06:29:57+00:00","note":"WPScan (CVSS 7.5, CWE-862) and the reporter's post: unauthenticated 2FA reset, <=1.0.16, no known fix. Both are third-party, not the vendor, so nothing is marked verified. PoC is withheld until 2026-12-09. No exploitation reported. Same plugin has 9 sibling CVEs (CVE-2026-123697 to -123705). X was not searched.","cites":["https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d"]}],"documents":[{"id":123302,"url":"https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":123288,"url":"https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8","title":"10 wordpress plugin vulns i reported are public","kind":"blog","source":"analyst","publisher":null,"text":"Researcher post: wpscan published 10 unauthenticated vulnerabilities in security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. No fix is available.","published_at":"2026-11-09T00:00:00+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}