---
id: "CVE-2026-123700"
page: "https://infrastack.ai/live/CVE-2026-123700"
kind: "vulnerability"
aliases: ["CVE-2026-123700"]
title: "WordPress WooCommerce security plugin lets anyone delete all site comments"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Security For WooCommerce", "fixed": [], "affected": "<= 1.0.16", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "self-hosted", "unauthenticated", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:19+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:28:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123700", "first_seen_at": "2026-11-11T06:25:43+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0", "first_seen_at": "2026-11-11T06:28:49+00:00", "cites": ["https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0", "https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8"]}]
exploit_sources: []
---

# WordPress WooCommerce security plugin lets anyone delete all site comments

Link for people: https://infrastack.ai/live/CVE-2026-123700 (this .md is for agents)

The Security For WooCommerce plugin through version 1.0.16 runs several comment cleanup actions without checking who is asking. An unauthenticated visitor can permanently delete every comment on the site, including approved comments and WooCommerce order notes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Security For WooCommerce affected <= 1.0.16 fixed no fixed version listed

## How to check

In WordPress admin > Plugins, check for 'Security For WooCommerce' (also called Ultimate Security for WooCommerce) at version 1.0.16 or lower. Or run: wp plugin list --name=security-for-woocommerce --fields=name,version,status

## Fix

No patched release known as of 2026-11-11 (WPScan: no known fix). Deactivate and delete the plugin until the vendor ships a fix.

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123700
- 2026-11-11T06:28:49+00:00 analyst https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0 — WPScan entry (CNA, linked) confirms <=1.0.16, CVSS 7.5, CWE-862, no known fix; PoC withheld until 2026-12-09; researcher post lists 10 sibling CVEs (123696-123705) in the same plugin. Vendor page not found, so nothing marked verified; not exploited as far as sources say.

## Documents

- [advisory] Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion (WPScan) https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0
- [describes] 10 wordpress plugin vulns i reported are public https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_