{"id":"CVE-2026-123701","kind":"vulnerability","aliases":["CVE-2026-123701"],"related":[],"title":"WordPress WooCommerce security plugin: unauthenticated users can reset settings","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.","summary":"The Security For WooCommerce WordPress plugin (slug ultimate-security-for-woocommerce) through 1.0.16 has no authorization check on its settings reset, so unauthenticated visitors can reset any configuration section to defaults, disabling custom login URL, 2FA, reCAPTCHA, password policies and the firewall. WPScan lists no known fix; the plugin looks unmaintained and has very few installs.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Security For WooCommerce","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ultimate-security-for-woocommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["other","plugin","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check for 'Security For WooCommerce' (folder wp-content/plugins/ultimate-security-for-woocommerce/); any version up to 1.0.16 is affected. Also check whether its security settings (login URL, 2FA, reCAPTCHA, firewall) have silently reverted to defaults.","fix":"No fixed version known: WPScan says no known fix and the WordPress.org page lists no release after 1.0.15. Deactivate and remove the plugin, or replace it with a maintained security plugin, and re-check your login hardening settings.","status":"open","published_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","triaged_at":"2026-11-11T06:27:11+00:00","updated_at":"2026-11-11T06:28:58+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T06:27:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce security plugin: unauthenticated users can reset settings","impact":"medium","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 lacks authorization checks on its settings reset, so anyone can reset its configuration to defaults. An attacker can thereby disable the custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker disables login protection and firewall on the site","analyst_note":"Confirm the fixed version and whether a patched release exists, from the WordPress.org plugin page or the NVD entry.","how_to_check":"- Check the installed version of the Security For WooCommerce plugin in the WordPress admin Plugins page; `1.0.16` or earlier is in the affected range.\n- Look for the plugin's directory under `wp-content/plugins/` on the server.","plain_action":"","product_name":"Security For WooCommerce","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin version 1.0.16 or earlier are exposed, because the settings reset action does not check whether the requester is logged in or authorized. Sites without this plugin, or running a later version, are not affected. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4554,"output_tokens":600,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patched release exists, from the WordPress.org plugin page or the NVD entry.","search":"'-123701':12A,15A '-2026':11A,14A '1.0.16':44B,95C '2fa':67B 'allow':106C 'authent':133C 'author':47B,100C 'check':48B,101C 'configur':59B,115C 'custom':64B,127C 'cve':10A,13A 'default':62B,118C 'disabl':63B,121C 'factor':132C 'featur':123C 'firewal':73B,139C 'fix':78B 'for':17A,22A 'host':28B 'instal':87B 'known':77B 'list':75B 'login':65B,128C 'look':81B 'password':69B,135C 'plugin':4A,25B,36B,80B,93C 'polici':70B,136C 'proper':99C 'recaptcha':68B,134C 'reset':8A,52B,57B,103C,110C 'section':60B,112C 'secur':3A,32B,40B,89C,122C 'security':16A,21A 'self':27B 'self-host':26B 'set':9A,51B,105C 'slug':37B 'two':131C 'two-factor':130C 'ultim':39B 'ultimate':20A 'ultimate-security-for-woocommerc':38B 'ultimate-security-for-woocommerce':19A 'unauthent':5A,54B,107C 'unmaintain':82B 'url':66B,129C 'user':6A,108C 'visitor':55B 'woocommerc':2A,29B,34B,42B,91C 'woocommerce':18A,23A 'wordpress':1A,30B,35B,92C 'wpscan':74B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security For WooCommerce WordPress plugin version 1.0.16 or earlier are exposed, because the settings reset action does not check whether the requester is logged in or authorized. Sites without this plugin, or running a later version, are not affected. The sources do not name a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["forwoocommerce","securityforwoocommerce","ultimatesecurityforwoocommerce"],"ptokens":["for","security","ultimate","woocommerce"],"labels":["high","other","plugin","selfhosted","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123701':12A,15A '-2026':11A,14A 'cve':10A,13A 'for':17A,22A 'plugin':4A 'reset':8A 'secur':3A 'security':16A,21A 'set':9A 'ultimate':20A 'ultimate-security-for-woocommerce':19A 'unauthent':5A 'user':6A 'woocommerc':2A 'woocommerce':18A,23A 'wordpress':1A","search_b":"'1.0.16':44B '2fa':67B 'author':47B 'check':48B 'configur':59B 'custom':64B 'default':62B 'disabl':63B 'firewal':73B 'fix':78B 'host':28B 'instal':87B 'known':77B 'list':75B 'login':65B 'look':81B 'password':69B 'plugin':25B,36B,80B 'polici':70B 'recaptcha':68B 'reset':52B,57B 'section':60B 'secur':32B,40B 'self':27B 'self-host':26B 'set':51B 'slug':37B 'ultim':39B 'ultimate-security-for-woocommerc':38B 'unauthent':54B 'unmaintain':82B 'url':66B 'visitor':55B 'woocommerc':29B,34B,42B 'wordpress':30B,35B 'wpscan':74B","search_c":"'1.0.16':95C 'allow':106C 'authent':133C 'author':100C 'check':101C 'configur':115C 'custom':127C 'default':118C 'disabl':121C 'factor':132C 'featur':123C 'firewal':139C 'login':128C 'password':135C 'plugin':93C 'polici':136C 'proper':99C 'recaptcha':134C 'reset':103C,110C 'section':112C 'secur':89C,122C 'set':105C 'two':131C 'two-factor':130C 'unauthent':107C 'url':129C 'user':108C 'woocommerc':91C 'wordpress':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123701","severity":null,"published_at":"2026-11-11T06:17:19+00:00","modified_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","fetched_at":"2026-11-11T06:25:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123701:3506","url":"https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e","severity":null,"published_at":"2026-11-11T06:28:58+00:00","modified_at":"2026-11-11T06:28:58+00:00","first_seen_at":"2026-11-11T06:28:58+00:00","fetched_at":"2026-11-11T06:28:58+00:00","note":"WPScan (third-party DB, researcher Benjamin Kincses) lists unauthenticated settings reset, CWE-862, CVSS 5.3, <=1.0.16, 'no known fix'; PoC withheld until 2026-11-23. WordPress.org page (author Rizvi) shows latest 1.0.15, no 1.0.16 or later, last updated Aug 2025, <10 installs, no security statement; no vendor statement of a fix, so fix-status left unknown. Nine sibling CVEs (123696-123702 etc.) in same plugin; one separate admin-creation CVE-2026-100109 (1.0.10-1.0.16).","cites":["https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e","https://wordpress.org/plugins/ultimate-security-for-woocommerce/"]}],"documents":[{"id":123294,"url":"https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e","title":"Security For WooCommerce <= 1.0.16 – Unauthenticated Plugin Settings Reset (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":74622,"url":"https://wordpress.org/plugins/ultimate-security-for-woocommerce/","title":"Security For WooCommerce – WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}