{"id":"CVE-2026-123698","kind":"vulnerability","aliases":["CVE-2026-123698"],"related":[],"title":"Security For WooCommerce plugin (<= 1.0.16) lets anyone read its settings, including secret keys, via an open REST route","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL.","summary":"WPScan reports that the Security For WooCommerce plugin (WordPress.org slug ultimate-security-for-woocommerce), versions up to and including 1.0.16, does not restrict access to one of its REST API routes. Unauthenticated users can retrieve its full settings, including configured secret keys and the hidden login URL. WPScan lists no known fix. The exact route is not published; WPScan will show the PoC on 2026-11-23. CVSS 5.3 (medium), CWE-862.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ultimate-security-for-woocommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","security-for-woocommerce","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Check whether the plugin ultimate-security-for-woocommerce (shown as Security For WooCommerce) is installed at version 1.0.16 or earlier: WordPress admin > Plugins, or run 'wp plugin get ultimate-security-for-woocommerce'. No fixed version exists to compare against.","fix":"No fixed version known as of 2026-11-11 (WPScan: 'No known fix'). Deactivate and remove the plugin or replace it. If it was exposed, rotate any secret keys configured in it and change the hidden login URL.","status":"open","published_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:15+00:00","updated_at":"2026-11-11T06:29:58+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T06:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce security plugin leaks secret keys via open REST route","impact":"high","summary":"The Security For WooCommerce WordPress plugin through version 1.0.16 has a REST API route with no access check. Unauthenticated visitors can read its full settings, including configured secret keys and the hidden login URL.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","security-for-woocommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads secret keys and the hidden login URL","analyst_note":"Confirm a fixed version and the exact REST route at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-123698 or the plugin's WordPress.org changelog.","how_to_check":"- Check whether the plugin is installed and its version is `1.0.16` or earlier, in the WordPress admin under Plugins, or with `wp plugin get security-for-woocommerce`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin at version 1.0.16 or earlier are exposed, since the flawed REST route answers without authentication. Sites without the plugin, or running a later version, are not affected per the sources. The sources do not state a fixed version or a workaround.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4527,"output_tokens":561,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm a fixed version and the exact REST route at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-123698 or the plugin's WordPress.org changelog.","search":"'-11':103B '-123698':21A,24A '-2026':20A,23A '-23':104B '-862':109B '1.0.16':5A,57B,117C '2026':102B '5.3':106B 'access':61B,121C 'allow':129C 'anyon':7A 'api':67B,127C 'configur':77B,138C 'cve':19A,22A 'cvss':105B 'cwe':108B 'exact':91B 'fix':89B 'for':28A 'full':74B,135C 'hidden':82B,143C 'includ':11A,56B,76B,137C 'key':13A,79B,140C 'known':88B 'let':6A 'list':86B 'login':83B,144C 'medium':107B 'one':63B,123C 'open':16A 'packag':30B 'plugin':4A,44B,115C 'poc':100B 'publish':95B 'read':8A 'report':38B 'rest':17A,66B,126C 'restrict':60B,120C 'retriev':72B,133C 'rout':18A,68B,92B,128C 'secret':12A,78B,139C 'secur':1A,32B,41B,49B,111C 'security':27A 'security-for-woocommerc':31B 'set':10A,75B,136C 'show':98B 'slug':46B 'ultim':48B 'ultimate':26A 'ultimate-security-for-woocommerc':47B 'ultimate-security-for-woocommerce':25A 'unauthent':69B,130C 'url':84B,145C 'user':70B,131C 'version':52B 'via':14A 'woocommerc':3A,34B,35B,43B,51B,113C 'woocommerce':29A 'wordpress':36B,114C 'wordpress.org':45B 'wpscan':37B,85B,96B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security For WooCommerce WordPress plugin at version 1.0.16 or earlier are exposed, since the flawed REST route answers without authentication. Sites without the plugin, or running a later version, are not affected per the sources. The sources do not state a fixed version or a workaround.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ultimatesecurityforwoocommerce"],"ptokens":["for","security","ultimate","woocommerce"],"labels":["high","package","securityforwoocommerce","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123698':21A,24A '-2026':20A,23A '1.0.16':5A 'anyon':7A 'cve':19A,22A 'for':28A 'includ':11A 'key':13A 'let':6A 'open':16A 'plugin':4A 'read':8A 'rest':17A 'rout':18A 'secret':12A 'secur':1A 'security':27A 'set':10A 'ultimate':26A 'ultimate-security-for-woocommerce':25A 'via':14A 'woocommerc':3A 'woocommerce':29A","search_b":"'-11':103B '-23':104B '-862':109B '1.0.16':57B '2026':102B '5.3':106B 'access':61B 'api':67B 'configur':77B 'cvss':105B 'cwe':108B 'exact':91B 'fix':89B 'full':74B 'hidden':82B 'includ':56B,76B 'key':79B 'known':88B 'list':86B 'login':83B 'medium':107B 'one':63B 'packag':30B 'plugin':44B 'poc':100B 'publish':95B 'report':38B 'rest':66B 'restrict':60B 'retriev':72B 'rout':68B,92B 'secret':78B 'secur':32B,41B,49B 'security-for-woocommerc':31B 'set':75B 'show':98B 'slug':46B 'ultim':48B 'ultimate-security-for-woocommerc':47B 'unauthent':69B 'url':84B 'user':70B 'version':52B 'woocommerc':34B,35B,43B,51B 'wordpress':36B 'wordpress.org':45B 'wpscan':37B,85B,96B","search_c":"'1.0.16':117C 'access':121C 'allow':129C 'api':127C 'configur':138C 'full':135C 'hidden':143C 'includ':137C 'key':140C 'login':144C 'one':123C 'plugin':115C 'rest':126C 'restrict':120C 'retriev':133C 'rout':128C 'secret':139C 'secur':111C 'set':136C 'unauthent':130C 'url':145C 'user':131C 'woocommerc':113C 'wordpress':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123698","severity":null,"published_at":"2026-11-11T06:17:18+00:00","modified_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123698:3509","url":"https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c","severity":null,"published_at":"2026-11-11T06:29:58+00:00","modified_at":"2026-11-11T06:29:58+00:00","first_seen_at":"2026-11-11T06:29:58+00:00","fetched_at":"2026-11-11T06:29:58+00:00","note":"WPScan advisory (third-party, not vendor) says <=1.0.16, no known fix, route unnamed, PoC due 2026-11-23. NVD page returned empty. Nothing verified: no vendor page. One of 10 sibling CVEs (123696-123702...) in the same plugin.","cites":["https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c"]}],"documents":[{"id":123304,"url":"https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Disclosure via REST API (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":123288,"url":"https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8","title":"10 wordpress plugin vulns i reported are public","kind":"blog","source":"analyst","publisher":null,"text":"Researcher post: wpscan published 10 unauthenticated vulnerabilities in security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. No fix is available.","published_at":"2026-11-09T00:00:00+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}