---
id: "CVE-2026-123699"
page: "https://infrastack.ai/live/CVE-2026-123699"
kind: "vulnerability"
aliases: ["CVE-2026-123699"]
title: "WordPress: Security For WooCommerce plugin lets anyone force plugin, theme and core updates"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Security For WooCommerce", "fixed": [], "affected": "<= 1.0.16", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:19+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:29:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123699", "first_seen_at": "2026-11-11T06:25:43+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23", "first_seen_at": "2026-11-11T06:29:53+00:00", "cites": ["https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23", "https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8"]}]
exploit_sources: []
---

# WordPress: Security For WooCommerce plugin lets anyone force plugin, theme and core updates

Link for people: https://infrastack.ai/live/CVE-2026-123699 (this .md is for agents)

The Security For WooCommerce plugin (slug ultimate-security-for-woocommerce) up to 1.0.16 does not check authorisation before running bulk updates. An unauthenticated visitor can force every pending plugin, theme and WordPress core update to be installed. WPScan lists no known fix. Per WPScan the flaw is limited to forced updates, one of 10 separate unauthenticated flaws in the same plugin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Security For WooCommerce affected <= 1.0.16 fixed no fixed version listed

## How to check

In WordPress admin > Plugins, find Security For WooCommerce (slug ultimate-security-for-woocommerce) and check its version; 1.0.16 or lower is affected. Or run: wp plugin get ultimate-security-for-woocommerce --field=version

## Fix

No fixed version known (WPScan: 'No known fix'). Deactivate and delete the plugin, or restrict access to it until the author releases a patch; keep updates applied on your own schedule.

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123699
- 2026-11-11T06:29:53+00:00 analyst https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23 — WPScan (secondary, researcher-submitted; no vendor page found) confirms scope is forced plugin/theme/core updates, <=1.0.16, no known fix, CVSS 4.8, PoC to be published 2026-11-23. NVD page returned empty. Nothing marked verified (no vendor source).

## Documents

- [advisory] Security For WooCommerce <= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core Updates (WPScan) https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23
- [describes] 10 wordpress plugin vulns i reported are public https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16,  and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_