---
id: "CVE-2026-123698"
page: "https://infrastack.ai/live/CVE-2026-123698"
kind: "vulnerability"
aliases: ["CVE-2026-123698"]
title: "Security For WooCommerce plugin (<= 1.0.16) lets anyone read its settings, including secret keys, via an open REST route"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ultimate-security-for-woocommerce", "fixed": [], "affected": "<= 1.0.16", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "security-for-woocommerce", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:18+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:29:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123698", "first_seen_at": "2026-11-11T06:25:43+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c", "first_seen_at": "2026-11-11T06:29:58+00:00", "cites": ["https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c"]}]
exploit_sources: []
---

# Security For WooCommerce plugin (<= 1.0.16) lets anyone read its settings, including secret keys, via an open REST route

Link for people: https://infrastack.ai/live/CVE-2026-123698 (this .md is for agents)

WPScan reports that the Security For WooCommerce plugin (WordPress.org slug ultimate-security-for-woocommerce), versions up to and including 1.0.16, does not restrict access to one of its REST API routes. Unauthenticated users can retrieve its full settings, including configured secret keys and the hidden login URL. WPScan lists no known fix. The exact route is not published; WPScan will show the PoC on 2026-11-23. CVSS 5.3 (medium), CWE-862.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ultimate-security-for-woocommerce affected <= 1.0.16 fixed no fixed version listed

## How to check

Check whether the plugin ultimate-security-for-woocommerce (shown as Security For WooCommerce) is installed at version 1.0.16 or earlier: WordPress admin > Plugins, or run 'wp plugin get ultimate-security-for-woocommerce'. No fixed version exists to compare against.

## Fix

No fixed version known as of 2026-11-11 (WPScan: 'No known fix'). Deactivate and remove the plugin or replace it. If it was exposed, rotate any secret keys configured in it and change the hidden login URL.

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123698
- 2026-11-11T06:29:58+00:00 analyst https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c — WPScan advisory (third-party, not vendor) says <=1.0.16, no known fix, route unnamed, PoC due 2026-11-23. NVD page returned empty. Nothing verified: no vendor page. One of 10 sibling CVEs (123696-123702...) in the same plugin.

## Documents

- [advisory] Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Disclosure via REST API (WPScan) https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c
- [discussion] 10 wordpress plugin vulns i reported are public https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_