{"id":"CVE-2026-123699","kind":"vulnerability","aliases":["CVE-2026-123699"],"related":[],"title":"WordPress: Security For WooCommerce plugin lets anyone force plugin, theme and core updates","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16,  and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.","summary":"The Security For WooCommerce plugin (slug ultimate-security-for-woocommerce) up to 1.0.16 does not check authorisation before running bulk updates. An unauthenticated visitor can force every pending plugin, theme and WordPress core update to be installed. WPScan lists no known fix. Per WPScan the flaw is limited to forced updates, one of 10 separate unauthenticated flaws in the same plugin.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Security For WooCommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, find Security For WooCommerce (slug ultimate-security-for-woocommerce) and check its version; 1.0.16 or lower is affected. Or run: wp plugin get ultimate-security-for-woocommerce --field=version","fix":"No fixed version known (WPScan: 'No known fix'). Deactivate and delete the plugin, or restrict access to it until the author releases a patch; keep updates applied on your own schedule.","status":"open","published_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:14+00:00","updated_at":"2026-11-11T06:29:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T06:27:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress: Security For WooCommerce plugin lets anyone force site updates","impact":"medium","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check whether a requester is authorised before running bulk updates. An unauthenticated visitor can force every pending plugin and WordPress core update to be installed on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated users force unwanted updates onto the site","analyst_note":"Confirm the fixed version and whether the flaw is limited to forced updates or also allows other actions, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-123699.","how_to_check":"- Look for the Security For WooCommerce plugin in the WordPress admin under Plugins and note its version.\n- Check that the installed version is `1.0.16` or lower, which the description marks as affected.","plain_action":"","product_name":"Security For WooCommerce","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Security For WooCommerce plugin at version 1.0.16 or earlier are described as affected. The flaw is reachable without logging in, so any WooCommerce store with the plugin installed should be treated as exposed until the sources say otherwise. Sites without this plugin are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4545,"output_tokens":593,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the flaw is limited to forced updates or also allows other actions, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-123699.","search":"'-123699':16A,19A '-2026':15A,18A '1.0.16':42B,98C,116C '10':83B 'allow':121C 'anyon':7A 'authoris':46B,106C 'bulk':49B,109C 'check':45B,101C 'core':12A,62B,119C 'cve':14A,17A 'everi':56B,126C 'fix':71B 'flaw':75B,86B 'for':21A 'forc':8A,55B,79B,125C 'host':26B 'instal':66B,131C 'known':70B 'let':6A 'limit':77B 'list':68B 'one':81B 'packag':23B 'pend':57B,127C 'per':72B 'plugin':5A,9A,33B,58B,90B,96C,114C 'request':104C 'run':48B,108C 'secur':2A,30B,37B,92C,110C 'security':20A 'self':25B 'self-host':24B 'separ':84B 'site':134C 'slug':34B 'theme':10A,59B 'ultim':36B 'ultimate-security-for-woocommerc':35B 'unauthent':52B,85B,122C 'updat':13A,50B,63B,80B,120C,128C 'user':123C 'visitor':53B 'woocommerc':4A,27B,32B,39B,94C,112C 'woocommerce':22A 'wordpress':1A,28B,61B,95C,113C,118C 'wpscan':67B,73B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress/WooCommerce site with the Security For WooCommerce plugin (ultimate-security-for-woocommerce) at 1.0.16 or earlier. No login is needed, so an installed plugin means exposure. The effect is that a visitor can trigger installation of pending updates, which can break the site or cause unplanned upgrades. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["forwoocommerce","securityforwoocommerce"],"ptokens":["for","security","woocommerce"],"labels":["high","package","selfhosted","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123699':16A,19A '-2026':15A,18A 'anyon':7A 'core':12A 'cve':14A,17A 'for':21A 'forc':8A 'let':6A 'plugin':5A,9A 'secur':2A 'security':20A 'theme':10A 'updat':13A 'woocommerc':4A 'woocommerce':22A 'wordpress':1A","search_b":"'1.0.16':42B '10':83B 'authoris':46B 'bulk':49B 'check':45B 'core':62B 'everi':56B 'fix':71B 'flaw':75B,86B 'forc':55B,79B 'host':26B 'instal':66B 'known':70B 'limit':77B 'list':68B 'one':81B 'packag':23B 'pend':57B 'per':72B 'plugin':33B,58B,90B 'run':48B 'secur':30B,37B 'self':25B 'self-host':24B 'separ':84B 'slug':34B 'theme':59B 'ultim':36B 'ultimate-security-for-woocommerc':35B 'unauthent':52B,85B 'updat':50B,63B,80B 'visitor':53B 'woocommerc':27B,32B,39B 'wordpress':28B,61B 'wpscan':67B,73B","search_c":"'1.0.16':98C,116C 'allow':121C 'authoris':106C 'bulk':109C 'check':101C 'core':119C 'everi':126C 'forc':125C 'instal':131C 'pend':127C 'plugin':96C,114C 'request':104C 'run':108C 'secur':92C,110C 'site':134C 'unauthent':122C 'updat':120C,128C 'user':123C 'woocommerc':94C,112C 'wordpress':95C,113C,118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123699","severity":null,"published_at":"2026-11-11T06:17:19+00:00","modified_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123699:3508","url":"https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23","severity":null,"published_at":"2026-11-11T06:29:53+00:00","modified_at":"2026-11-11T06:29:53+00:00","first_seen_at":"2026-11-11T06:29:53+00:00","fetched_at":"2026-11-11T06:29:53+00:00","note":"WPScan (secondary, researcher-submitted; no vendor page found) confirms scope is forced plugin/theme/core updates, <=1.0.16, no known fix, CVSS 4.8, PoC to be published 2026-11-23. NVD page returned empty. Nothing marked verified (no vendor source).","cites":["https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23","https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8"]}],"documents":[{"id":123303,"url":"https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core Updates (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":"Plugin does not check requester is authorised before running bulk plugin, theme and WordPress core updates; unauthenticated users can force every pending update. Slug ultimate-security-for-woocommerce. No known fix. CVSS 4.8 medium, CWE-862. PoC to be shown Nov 23, 2026. Researcher Benjamin Kincses.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":123288,"url":"https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8","title":"10 wordpress plugin vulns i reported are public","kind":"blog","source":"analyst","publisher":null,"text":"Researcher post: wpscan published 10 unauthenticated vulnerabilities in security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. No fix is available.","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}