{"id":"CVE-2026-123703","kind":"vulnerability","aliases":["CVE-2026-123703"],"related":[],"title":"Security For WooCommerce WordPress plugin lets anyone log out users","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request.","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check authorisation before ending login sessions. An unauthenticated visitor can log out any user, including administrators, and keep them logged out by repeating the request.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","security-for-woocommerce","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `Security For WooCommerce` plugin is installed and its version is `1.0.16` or earlier in the WordPress admin plugin list","fix":null,"status":"open","published_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","triaged_at":"2026-11-11T06:27:10+00:00","updated_at":"2026-11-11T06:27:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Security For WooCommerce WordPress plugin lets anyone log out users","impact":"low","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check authorisation before ending login sessions. An unauthenticated visitor can log out any user, including administrators, and keep them logged out by repeating the request.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","security-for-woocommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Any visitor logs out administrators and blocks their sessions","analyst_note":"Find the patched plugin version and vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-123703 or the WordPress plugin page.","how_to_check":"- Check whether the `Security For WooCommerce` plugin is installed and its version is `1.0.16` or earlier in the WordPress admin plugin list\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin at version 1.0.16 or earlier are exposed, since the flaw needs no login. Sites without this plugin, or with a later version, are not affected according to the sources. The sources do not say which later version is fixed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4531,"output_tokens":550,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123703':13A,16A '-2026':12A,15A '1.0.16':31B,66C 'administr':49B,91C 'allow':82C 'anyon':7A 'authoris':35B,74C 'check':34B,69C 'cve':11A,14A 'end':37B,76C 'includ':48B,90C 'keep':51B,94C 'let':6A 'log':8A,44B,53B,86C,96C 'login':38B,80C 'packag':17B 'plugin':5A,29B,64C 'repeat':56B,99C 'request':58B,72C,101C 'secur':1A,19B,25B,60C 'security-for-woocommerc':18B 'session':39B,81C 'unauthent':41B,83C 'user':10A,47B,78C,89C 'visitor':42B,84C 'woocommerc':3A,21B,22B,27B,62C 'wordpress':4A,23B,28B,63C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security For WooCommerce WordPress plugin at version 1.0.16 or earlier are exposed, since the flaw needs no login. Sites without this plugin, or with a later version, are not affected according to the sources. The sources do not say which later version is fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","securityforwoocommerce","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123703':13A,16A '-2026':12A,15A 'anyon':7A 'cve':11A,14A 'let':6A 'log':8A 'plugin':5A 'secur':1A 'user':10A 'woocommerc':3A 'wordpress':4A","search_b":"'1.0.16':31B 'administr':49B 'authoris':35B 'check':34B 'end':37B 'includ':48B 'keep':51B 'log':44B,53B 'login':38B 'packag':17B 'plugin':29B 'repeat':56B 'request':58B 'secur':19B,25B 'security-for-woocommerc':18B 'session':39B 'unauthent':41B 'user':47B 'visitor':42B 'woocommerc':21B,22B,27B 'wordpress':23B,28B","search_c":"'1.0.16':66C 'administr':91C 'allow':82C 'authoris':74C 'check':69C 'end':76C 'includ':90C 'keep':94C 'log':86C,96C 'login':80C 'plugin':64C 'repeat':99C 'request':72C,101C 'secur':60C 'session':81C 'unauthent':83C 'user':78C,89C 'visitor':84C 'woocommerc':62C 'wordpress':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123703","severity":null,"published_at":"2026-11-11T06:17:19+00:00","modified_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","fetched_at":"2026-11-11T06:25:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}