---
id: "CVE-2026-123697"
page: "https://infrastack.ai/live/CVE-2026-123697"
kind: "vulnerability"
aliases: ["CVE-2026-123697"]
title: "Security For WooCommerce WordPress plugin (<= 1.0.16) hands out two-factor codes and secrets to anyone; no fix"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Security For WooCommerce", "fixed": [], "affected": "<= 1.0.16", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["no-fix", "other", "two-factor-auth", "woocommerce", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-newer-than-1.0.16", "plugin-not-installed", "two-factor-feature-unused"]
published_at: "2026-11-11T06:17:18+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:30:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123697", "first_seen_at": "2026-11-11T06:25:43+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/", "first_seen_at": "2026-11-11T06:30:08+00:00", "cites": ["https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/"]}]
exploit_sources: []
---

# Security For WooCommerce WordPress plugin (<= 1.0.16) hands out two-factor codes and secrets to anyone; no fix

Link for people: https://infrastack.ai/live/CVE-2026-123697 (this .md is for agents)

The Security For WooCommerce WordPress plugin through 1.0.16 lets unauthenticated visitors request any user's current two-factor code or two-factor secret. An attacker who gets these can log in as that account and bypass the second factor.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:Security For WooCommerce affected <= 1.0.16 fixed no fixed version listed

## How to check

- In WordPress admin > Plugins (or run: wp plugin list), look for Security For WooCommerce (slug may be ultimate-security-for-woocommerce) at version 1.0.16 or earlier. Every listed version is affected; no fix exists.
- The advisory says the bypass works on sites where the plugin's one-time password library is available; WPScan does not say how to test that, so treat any site with the plugin and its two-factor feature enabled as exposed.
- Also check if you run the same plugin for other flaws: the same versions have separate unauthenticated flaws (e.g. CVE-2026-100109 admin account creation, 1.0.10-1.0.16). Review administrator accounts.

## Fix

No fixed version: WPScan lists no known fix for versions through 1.0.16. Until one ships, deactivate and remove the plugin (or disable its two-factor feature) and use a different 2FA method.

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123697
- 2026-11-11T06:30:08+00:00 analyst https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/ — Primary: WPScan (CNA) entry, only source; says no known fix, CVSS 7.5, PoC withheld until 2026-12-09. OTP-library condition is as worded there, not further explained. Vendor page/changelog not found, so nothing marked verified. Search of X skipped. Sibling CVEs from same researcher (123696-123703, 100109).

## Documents

- [advisory] Security For WooCommerce <= 1.0.16 – Unauthenticated Two-Factor Code and Secret Disclosure (WPScan) https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/
- [discussion] 10 wordpress plugin vulns i reported are public https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_