---
id: "CVE-2026-123701"
page: "https://infrastack.ai/live/CVE-2026-123701"
kind: "vulnerability"
aliases: ["CVE-2026-123701"]
title: "WordPress WooCommerce security plugin: unauthenticated users can reset settings"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Security For WooCommerce", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ultimate-security-for-woocommerce", "fixed": [], "affected": "<= 1.0.16", "ecosystem": "wordpress"}]
ecosystems: ["vendor"]
tags: ["other", "plugin", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:19+00:00"
first_seen_at: "2026-11-11T06:25:44+00:00"
updated_at: "2026-11-11T06:28:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123701", "first_seen_at": "2026-11-11T06:25:44+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e", "first_seen_at": "2026-11-11T06:28:58+00:00", "cites": ["https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e", "https://wordpress.org/plugins/ultimate-security-for-woocommerce/"]}]
exploit_sources: []
---

# WordPress WooCommerce security plugin: unauthenticated users can reset settings

Link for people: https://infrastack.ai/live/CVE-2026-123701 (this .md is for agents)

The Security For WooCommerce WordPress plugin (slug ultimate-security-for-woocommerce) through 1.0.16 has no authorization check on its settings reset, so unauthenticated visitors can reset any configuration section to defaults, disabling custom login URL, 2FA, reCAPTCHA, password policies and the firewall. WPScan lists no known fix; the plugin looks unmaintained and has very few installs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Security For WooCommerce affected range not listed fixed no fixed version listed
- wordpress:ultimate-security-for-woocommerce affected <= 1.0.16 fixed no fixed version listed

## How to check

In WordPress admin > Plugins, check for 'Security For WooCommerce' (folder wp-content/plugins/ultimate-security-for-woocommerce/); any version up to 1.0.16 is affected. Also check whether its security settings (login URL, 2FA, reCAPTCHA, firewall) have silently reverted to defaults.

## Fix

No fixed version known: WPScan says no known fix and the WordPress.org page lists no release after 1.0.15. Deactivate and remove the plugin, or replace it with a maintained security plugin, and re-check your login hardening settings.

## Timeline

- 2026-11-11T06:25:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123701
- 2026-11-11T06:28:58+00:00 analyst https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e — WPScan (third-party DB, researcher Benjamin Kincses) lists unauthenticated settings reset, CWE-862, CVSS 5.3, <=1.0.16, 'no known fix'; PoC withheld until 2026-11-23. WordPress.org page (author Rizvi) shows latest 1.0.15, no 1.0.16 or later, last updated Aug 2025, <10 installs, no security statement; no vendor statement of a fix, so fix-status left unknown. Nine sibling CVEs (123696-123702 etc.) in same plugin; one separate admin-creation CVE-2026-100109 (1.0.10-1.0.16).

## Documents

- [advisory] Security For WooCommerce <= 1.0.16 – Unauthenticated Plugin Settings Reset (WPScan) https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e
- [describes] Security For WooCommerce – WordPress.org plugin page https://wordpress.org/plugins/ultimate-security-for-woocommerce/

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_