ULTIMATE-SECURITY-FOR-WOOCOMMERCE · CVE-2026-123702 · Package
NO FIX YET · SEE WHAT TO DO
The Security For WooCommerce WordPress plugin through version 1.0.16 does not check authorisation before regenerating the secret keys and salts in the site's wp-config file. An unauthenticated visitor can log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the site offline.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Security For WooCommerce WordPress plugin through version 1.0.16 are exposed, since the flaw needs no login. Servers that cannot reach the WordPress.org API are at risk of configuration corruption and full site downtime. Sites without this plugin installed are not affected.
Not affected if plugin-not-installed
Who cares self-hosted, woocommerce, wordpress
Security For WooCommerce (slug ultimate-security-for-woocommerce)1.0.16 is affected, and since there is no fix, the plugin being active is the exposurePosts are quoted with a link to the original. They are data to us, never instructions.
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.0.16