---
id: "CVE-2026-123702"
page: "https://infrastack.ai/live/CVE-2026-123702"
kind: "vulnerability"
aliases: ["CVE-2026-123702"]
title: "WordPress WooCommerce security plugin: unauthenticated secret key regeneration logs out users"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ultimate-security-for-woocommerce", "fixed": [], "affected": "<= 1.0.16", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:19+00:00"
first_seen_at: "2026-11-11T06:25:44+00:00"
updated_at: "2026-11-11T06:30:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123702", "first_seen_at": "2026-11-11T06:25:44+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5", "first_seen_at": "2026-11-11T06:28:42+00:00", "cites": ["https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5"]}]
exploit_sources: []
---

# WordPress WooCommerce security plugin: unauthenticated secret key regeneration logs out users

Link for people: https://infrastack.ai/live/CVE-2026-123702 (this .md is for agents)

The Security For WooCommerce WordPress plugin through version 1.0.16 does not check authorisation before regenerating the secret keys and salts in the site's wp-config file. An unauthenticated visitor can log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the site offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ultimate-security-for-woocommerce affected <= 1.0.16 fixed no fixed version listed

## How to check

In WordPress admin > Plugins, look for 'Security For WooCommerce' (slug ultimate-security-for-woocommerce). Any installed version up to and including 1.0.16 is affected, and since there is no fix, the plugin being active is the exposure. Or run: wp plugin list --name=ultimate-security-for-woocommerce

## Fix

No fixed version exists as of 2026-11-11 (WPScan: no known fix). Deactivate and delete the plugin until the author ships a release above 1.0.16.

## Timeline

- 2026-11-11T06:25:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123702
- 2026-11-11T06:28:42+00:00 analyst https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5 — WPScan (CNA, verified entry) lists ultimate-security-for-woocommerce <= 1.0.16, no known fix, CVSS 6.5, PoC withheld until 2026-11-23. Same plugin has sibling CVEs 123696-123705. No vendor page found.

## Documents

- [advisory] WPScan: Security For WooCommerce <= 1.0.16 wp-config Keys and Salts Reset and DoS https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5
- [discussion] 10 wordpress plugin vulns i reported are public https://dev.to/benjaminkincses/10-wordpress-plugin-vulns-i-reported-are-public-13i8

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_