{"id":"CVE-2026-123697","kind":"vulnerability","aliases":["CVE-2026-123697"],"related":[],"title":"Security For WooCommerce WordPress plugin (<= 1.0.16) hands out two-factor codes and secrets to anyone; no fix","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 lets unauthenticated visitors request any user's current two-factor code or two-factor secret. An attacker who gets these can log in as that account and bypass the second factor.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Security For WooCommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["no-fix","other","two-factor-auth","woocommerce","wordpress","wordpress-plugin"],"not_affected_if":["plugin-newer-than-1.0.16","plugin-not-installed","two-factor-feature-unused"],"how_to_check":"- In WordPress admin > Plugins (or run: wp plugin list), look for Security For WooCommerce (slug may be ultimate-security-for-woocommerce) at version 1.0.16 or earlier. Every listed version is affected; no fix exists.\n- The advisory says the bypass works on sites where the plugin's one-time password library is available; WPScan does not say how to test that, so treat any site with the plugin and its two-factor feature enabled as exposed.\n- Also check if you run the same plugin for other flaws: the same versions have separate unauthenticated flaws (e.g. CVE-2026-100109 admin account creation, 1.0.10-1.0.16). Review administrator accounts.","fix":"No fixed version: WPScan lists no known fix for versions through 1.0.16. Until one ships, deactivate and remove the plugin (or disable its two-factor feature) and use a different 2FA method.","status":"open","published_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:15+00:00","updated_at":"2026-11-11T06:30:08+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-11T06:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce security plugin leaks two-factor codes to anyone","impact":"high","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 lets unauthenticated visitors request any user's current two-factor code or two-factor secret. An attacker who gets these can log in as that account and bypass the second factor.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","two-factor-auth"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker logs in as any account by bypassing two-factor authentication","analyst_note":"Confirm a fixed version and the one-time password library condition from the NVD entry or the plugin's changelog.","how_to_check":"- Check whether the `Security For WooCommerce` plugin is installed and at version `1.0.16` or earlier in the WordPress plugins list.\n- Check whether the site's one-time password library is available, since the sources say the bypass needs it.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-1.0.16"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin through 1.0.16 where its one-time password library is available. The sources do not say which configurations beyond that are exposed, and the sources do not describe a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4535,"output_tokens":544,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm a fixed version and the one-time password library condition from the NVD entry or the plugin's changelog.","search":"'-123697':21A,24A '-2026':20A,23A '1.0.16':6A,48B,89C 'account':76B,117C 'allow':109C 'anyon':16A 'attack':67B 'auth':35B 'avail':133C 'bypass':78B,119C 'code':12A,60B,103C 'current':56B,99C 'cve':19A,22A 'factor':11A,34B,59B,64B,81B,102C,107C,122C 'fix':18A,30B 'for':26A 'get':69B 'hand':7A 'let':49B 'librari':131C 'log':72B 'no-fix':28B 'obtain':113C 'one':128C 'one-tim':127C 'password':130C 'plugin':5A,40B,46B,87C 'request':52B,95C 'restrict':92C 'second':80B,121C 'secret':14A,65B,108C 'secur':1A,42B,83C 'security':25A 'site':124C 'time':129C 'two':10A,33B,58B,63B,101C,106C 'two-factor':9A,57B,62B,100C,105C 'two-factor-auth':32B 'unauthent':50B,110C 'user':54B,97C,111C 'visitor':51B 'woocommerc':3A,36B,44B,85C 'woocommerce':27A 'wordpress':4A,37B,39B,45B,86C 'wordpress-plugin':38B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress/WooCommerce site running the Security For WooCommerce plugin version 1.0.16 or earlier, using its two-factor login. An unauthenticated visitor can request any account's current 2FA code or secret and so skip the second factor, on sites where the plugin's one-time password library is available. Sites without the plugin, or that use a different 2FA plugin, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["forwoocommerce","securityforwoocommerce"],"ptokens":["for","security","woocommerce"],"labels":["high","nofix","other","twofactorauth","woocommerce","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-123697':21A,24A '-2026':20A,23A '1.0.16':6A 'anyon':16A 'code':12A 'cve':19A,22A 'factor':11A 'fix':18A 'for':26A 'hand':7A 'plugin':5A 'secret':14A 'secur':1A 'security':25A 'two':10A 'two-factor':9A 'woocommerc':3A 'woocommerce':27A 'wordpress':4A","search_b":"'1.0.16':48B 'account':76B 'attack':67B 'auth':35B 'bypass':78B 'code':60B 'current':56B 'factor':34B,59B,64B,81B 'fix':30B 'get':69B 'let':49B 'log':72B 'no-fix':28B 'plugin':40B,46B 'request':52B 'second':80B 'secret':65B 'secur':42B 'two':33B,58B,63B 'two-factor':57B,62B 'two-factor-auth':32B 'unauthent':50B 'user':54B 'visitor':51B 'woocommerc':36B,44B 'wordpress':37B,39B,45B 'wordpress-plugin':38B","search_c":"'1.0.16':89C 'account':117C 'allow':109C 'avail':133C 'bypass':119C 'code':103C 'current':99C 'factor':102C,107C,122C 'librari':131C 'obtain':113C 'one':128C 'one-tim':127C 'password':130C 'plugin':87C 'request':95C 'restrict':92C 'second':121C 'secret':108C 'secur':83C 'site':124C 'time':129C 'two':101C,106C 'two-factor':100C,105C 'unauthent':110C 'user':97C,111C 'woocommerc':85C 'wordpress':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123697","severity":null,"published_at":"2026-11-11T06:17:18+00:00","modified_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123697:3510","url":"https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/","severity":null,"published_at":"2026-11-11T06:30:08+00:00","modified_at":"2026-11-11T06:30:08+00:00","first_seen_at":"2026-11-11T06:30:08+00:00","fetched_at":"2026-11-11T06:30:08+00:00","note":"Primary: WPScan (CNA) entry, only source; says no known fix, CVSS 7.5, PoC withheld until 2026-12-09. OTP-library condition is as worded there, not further explained. Vendor page/changelog not found, so nothing marked verified. Search of X skipped. Sibling CVEs from same researcher (123696-123703, 100109).","cites":["https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/"]}],"documents":[{"id":123308,"url":"https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/","title":"Security For WooCommerce <= 1.0.16 – Unauthenticated Two-Factor Code and Secret Disclosure (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":"Plugin does not restrict who can request a user's current two-factor code or secret; unauthenticated users can obtain them for any account and bypass the second factor on sites where its one-time password library is available. No known fix. CVSS 7.5, CWE-862. PoC to be displayed 2026-12-09. Researcher Benjamin Kincses. Published 2026-11-09.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":123288,"url":"https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8","title":"10 wordpress plugin vulns i reported are public","kind":"blog","source":"analyst","publisher":null,"text":"Researcher post: wpscan published 10 unauthenticated vulnerabilities in security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. No fix is available.","published_at":"2026-11-09T00:00:00+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}