CVE-2026-123703 · Package
NO FIX YET
The Security For WooCommerce WordPress plugin through 1.0.16 does not check authorisation before ending login sessions. An unauthenticated visitor can log out any user, including administrators, and keep them logged out by repeating the request.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Security For WooCommerce WordPress plugin at version 1.0.16 or earlier are exposed, since the flaw needs no login. Sites without this plugin, or with a later version, are not affected according to the sources. The sources do not say which later version is fixed.
Not affected if plugin-not-installed
Who cares security-for-woocommerce, woocommerce, wordpress
Security For WooCommerce plugin is installed and its version is 1.0.16 or earlier in the WordPress admin plugin listNo fix yet, per the sources.
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.