{"id":"CVE-2026-123700","kind":"vulnerability","aliases":["CVE-2026-123700"],"related":[],"title":"WordPress WooCommerce security plugin lets anyone delete all site comments","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes.","summary":"The Security For WooCommerce plugin through version 1.0.16 runs several comment cleanup actions without checking who is asking. An unauthenticated visitor can permanently delete every comment on the site, including approved comments and WooCommerce order notes.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Security For WooCommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","self-hosted","unauthenticated","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check for 'Security For WooCommerce' (also called Ultimate Security for WooCommerce) at version 1.0.16 or lower. Or run: wp plugin list --name=security-for-woocommerce --fields=name,version,status","fix":"No patched release known as of 2026-11-11 (WPScan: no known fix). Deactivate and delete the plugin until the vendor ships a fix.","status":"open","published_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:11+00:00","updated_at":"2026-11-11T06:28:49+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-11T06:27:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce security plugin lets anyone delete all site comments","impact":"medium","summary":"The Security For WooCommerce plugin through version 1.0.16 runs several comment cleanup actions without checking who is asking. An unauthenticated visitor can permanently delete every comment on the site, including approved comments and WooCommerce order notes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated users permanently delete all site comments and order notes","analyst_note":"Confirm fixed version and whether a patched release exists at https://nvd.nist.gov/vuln/detail/CVE-2026-123700 or the WordPress plugin page.","how_to_check":"- Check whether the `Security For WooCommerce` plugin is installed and its version is `1.0.16` or lower in the WordPress admin under Plugins\n- unknown","plain_action":"","product_name":"Security For WooCommerce","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Security For WooCommerce plugin at version 1.0.16 or earlier are exposed, since the flawed cleanup actions do not verify the requester. Sites without this plugin are not affected. The sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4535,"output_tokens":561,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm fixed version and whether a patched release exists at https://nvd.nist.gov/vuln/detail/CVE-2026-123700 or the WordPress plugin page.","search":"'-123700':13A,16A '-2026':12A,15A '1.0.16':34B,70C 'action':39B,86C 'allow':87C 'anyon':6A 'approv':57B,99C 'ask':44B 'authoris':78C 'check':41B,73C 'cleanup':38B,85C 'comment':10A,37B,52B,58B,84C,94C 'cve':11A,14A 'delet':7A,50B,92C 'everi':51B 'for':18A 'host':23B 'includ':56B,98C 'let':5A 'note':62B,104C 'one':100C 'order':61B,103C 'perman':49B,91C 'plugin':4A,31B,68C 'request':76C 'run':35B,80C 'secur':3A,28B,64C 'security':17A 'self':22B 'self-host':21B 'sever':36B,81C 'site':9A,55B,97C 'unauthent':24B,46B,88C 'user':89C 'version':33B 'visitor':47B 'without':40B 'woocommerc':2A,25B,30B,60B,66C,102C 'woocommerce':19A 'wordpress':1A,26B,67C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Security For WooCommerce plugin version 1.0.16 or lower. Anyone on the internet can permanently delete all comments, including approved comments and WooCommerce order notes, without logging in. Sites that don't have this plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["forwoocommerce","securityforwoocommerce"],"ptokens":["for","security","woocommerce"],"labels":["high","other","selfhosted","unauthenticated","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123700':13A,16A '-2026':12A,15A 'anyon':6A 'comment':10A 'cve':11A,14A 'delet':7A 'for':18A 'let':5A 'plugin':4A 'secur':3A 'security':17A 'site':9A 'woocommerc':2A 'woocommerce':19A 'wordpress':1A","search_b":"'1.0.16':34B 'action':39B 'approv':57B 'ask':44B 'check':41B 'cleanup':38B 'comment':37B,52B,58B 'delet':50B 'everi':51B 'host':23B 'includ':56B 'note':62B 'order':61B 'perman':49B 'plugin':31B 'run':35B 'secur':28B 'self':22B 'self-host':21B 'sever':36B 'site':55B 'unauthent':24B,46B 'version':33B 'visitor':47B 'without':40B 'woocommerc':25B,30B,60B 'wordpress':26B","search_c":"'1.0.16':70C 'action':86C 'allow':87C 'approv':99C 'authoris':78C 'check':73C 'cleanup':85C 'comment':84C,94C 'delet':92C 'includ':98C 'note':104C 'one':100C 'order':103C 'perman':91C 'plugin':68C 'request':76C 'run':80C 'secur':64C 'sever':81C 'site':97C 'unauthent':88C 'user':89C 'woocommerc':66C,102C 'wordpress':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123700","severity":null,"published_at":"2026-11-11T06:17:19+00:00","modified_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123700:3507","url":"https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0","severity":null,"published_at":"2026-11-11T06:28:49+00:00","modified_at":"2026-11-11T06:28:49+00:00","first_seen_at":"2026-11-11T06:28:49+00:00","fetched_at":"2026-11-11T06:28:49+00:00","note":"WPScan entry (CNA, linked) confirms <=1.0.16, CVSS 7.5, CWE-862, no known fix; PoC withheld until 2026-12-09; researcher post lists 10 sibling CVEs (123696-123705) in the same plugin. Vendor page not found, so nothing marked verified; not exploited as far as sources say.","cites":["https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0","https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8"]}],"documents":[{"id":123289,"url":"https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":123288,"url":"https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8","title":"10 wordpress plugin vulns i reported are public","kind":"blog","source":"analyst","publisher":null,"text":"Researcher post: wpscan published 10 unauthenticated vulnerabilities in security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. No fix is available.","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}