{"id":"CVE-2026-123702","kind":"vulnerability","aliases":["CVE-2026-123702"],"related":[],"title":"WordPress WooCommerce security plugin: unauthenticated secret key regeneration logs out users","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.","summary":"The Security For WooCommerce WordPress plugin through version 1.0.16 does not check authorisation before regenerating the secret keys and salts in the site's wp-config file. An unauthenticated visitor can log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the site offline.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ultimate-security-for-woocommerce","fixed":[],"affected":"<= 1.0.16","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, look for 'Security For WooCommerce' (slug ultimate-security-for-woocommerce). Any installed version up to and including 1.0.16 is affected, and since there is no fix, the plugin being active is the exposure. Or run: wp plugin list --name=ultimate-security-for-woocommerce","fix":"No fixed version exists as of 2026-11-11 (WPScan: no known fix). Deactivate and delete the plugin until the author ships a release above 1.0.16.","status":"open","published_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","triaged_at":"2026-11-11T06:27:11+00:00","updated_at":"2026-11-11T06:30:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T06:27:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce security plugin: unauthenticated secret key regeneration logs out users","impact":"medium","summary":"The Security For WooCommerce WordPress plugin through version 1.0.16 does not check authorisation before regenerating the secret keys and salts in the site's wp-config file. An unauthenticated visitor can log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the site offline.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker logs out all users and can take the site offline","analyst_note":"Confirm the fixed version and any vendor advisory at the NVD entry; the sources give no fix version.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; versions through `1.0.16` are listed as affected.\n- Confirm the plugin is active on the site.\n- unknown whether the sources name a specific check beyond the version.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin through version 1.0.16 are exposed, since the flaw needs no login. Servers that cannot reach the WordPress.org API are at risk of configuration corruption and full site downtime. Sites without this plugin installed are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000743,"input_tokens":4557,"output_tokens":575,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory at the NVD entry; the sources give no fix version.","search":"'-123702':14A,17A '-2026':13A,16A '1.0.16':37B,90C 'allow':112C 'api':73B,128C 'authoris':41B,98C 'cannot':69B,124C 'check':40B,93C 'config':55B 'configur':76B,110C,131C 'corrupt':74B,129C 'cve':12A,15A 'everi':63B,118C 'file':56B,77B,111C,132C 'for':21A 'host':26B 'key':7A,46B,103C 'log':9A,61B,116C 'offlin':82B,138C 'packag':23B 'plugin':4A,34B,88C 'reach':70B,125C 'regener':8A,43B,100C 'request':96C 'salt':48B,105C 'secret':6A,45B,102C 'secur':3A,30B,84C 'security':20A 'self':25B 'self-host':24B 'server':67B,122C 'site':51B,81B,108C,137C 'take':79B,134C 'ultimate':19A 'ultimate-security-for-woocommerce':18A 'unauthent':5A,58B,113C 'user':11A,64B,114C,119C 'version':36B 'visitor':59B 'whole':136C 'woocommerc':2A,27B,32B,86C 'woocommerce':22A 'wordpress':1A,28B,33B,87C 'wordpress.org':72B,127C 'wp':54B 'wp-config':53B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security For WooCommerce WordPress plugin through version 1.0.16 are exposed, since the flaw needs no login. Servers that cannot reach the WordPress.org API are at risk of configuration corruption and full site downtime. Sites without this plugin installed are not affected.","tier":"C","verified":{"fix":{"at":"2026-11-11T06:28:42Z","by":"analyst","doc":"https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5","run_id":3505}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ultimatesecurityforwoocommerce"],"ptokens":["for","security","ultimate","woocommerce"],"labels":["medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123702':14A,17A '-2026':13A,16A 'cve':12A,15A 'for':21A 'key':7A 'log':9A 'plugin':4A 'regener':8A 'secret':6A 'secur':3A 'security':20A 'ultimate':19A 'ultimate-security-for-woocommerce':18A 'unauthent':5A 'user':11A 'woocommerc':2A 'woocommerce':22A 'wordpress':1A","search_b":"'1.0.16':37B 'api':73B 'authoris':41B 'cannot':69B 'check':40B 'config':55B 'configur':76B 'corrupt':74B 'everi':63B 'file':56B,77B 'host':26B 'key':46B 'log':61B 'offlin':82B 'packag':23B 'plugin':34B 'reach':70B 'regener':43B 'salt':48B 'secret':45B 'secur':30B 'self':25B 'self-host':24B 'server':67B 'site':51B,81B 'take':79B 'unauthent':58B 'user':64B 'version':36B 'visitor':59B 'woocommerc':27B,32B 'wordpress':28B,33B 'wordpress.org':72B 'wp':54B 'wp-config':53B","search_c":"'1.0.16':90C 'allow':112C 'api':128C 'authoris':98C 'cannot':124C 'check':93C 'configur':110C,131C 'corrupt':129C 'everi':118C 'file':111C,132C 'key':103C 'log':116C 'offlin':138C 'plugin':88C 'reach':125C 'regener':100C 'request':96C 'salt':105C 'secret':102C 'secur':84C 'server':122C 'site':108C,137C 'take':134C 'unauthent':113C 'user':114C,119C 'whole':136C 'woocommerc':86C 'wordpress':87C 'wordpress.org':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123702","severity":null,"published_at":"2026-11-11T06:17:19+00:00","modified_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","fetched_at":"2026-11-11T06:25:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123702:3505","url":"https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5","severity":null,"published_at":"2026-11-11T06:28:42+00:00","modified_at":"2026-11-11T06:28:42+00:00","first_seen_at":"2026-11-11T06:28:42+00:00","fetched_at":"2026-11-11T06:28:42+00:00","note":"WPScan (CNA, verified entry) lists ultimate-security-for-woocommerce <= 1.0.16, no known fix, CVSS 6.5, PoC withheld until 2026-11-23. Same plugin has sibling CVEs 123696-123705. No vendor page found.","cites":["https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5"]}],"documents":[{"id":123287,"url":"https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5","title":"WPScan: Security For WooCommerce <= 1.0.16 wp-config Keys and Salts Reset and DoS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":123288,"url":"https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8","title":"10 wordpress plugin vulns i reported are public","kind":"blog","source":"analyst","publisher":null,"text":"Researcher post: wpscan published 10 unauthenticated vulnerabilities in security for woocommerce (ultimate security for woocommerce), versions <= 1.0.16. No fix is available.","published_at":"2026-11-09T00:00:00+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}