SECURITY FOR WOOCOMMERCE · CVE-2026-123700 · Other
NO FIX YET · SEE WHAT TO DO
The Security For WooCommerce plugin through version 1.0.16 runs several comment cleanup actions without checking who is asking. An unauthenticated visitor can permanently delete every comment on the site, including approved comments and WooCommerce order notes.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site running the Security For WooCommerce plugin version 1.0.16 or lower. Anyone on the internet can permanently delete all comments, including approved comments and WooCommerce order notes, without logging in. Sites that don't have this plugin installed can skip it.
Not affected if plugin-not-installed
Who cares self-hosted, unauthenticated, woocommerce, wordpress
Security For WooCommerce (also called Ultimate Security for WooCommerce) at version 1.0.16 or lowerPosts are quoted with a link to the original. They are data to us, never instructions.
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.