{"id":"CVE-2026-123704","kind":"vulnerability","aliases":["CVE-2026-123704"],"related":[],"title":"WooCommerce security plugin leaks every administrator's email address to anyone","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 exposes one of its REST API routes without access checks. An unauthenticated visitor can retrieve the email address of every administrator on the site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Security For WooCommerce plugin in the WordPress admin plugin list; versions up to `1.0.16` are affected.\n- Test whether the REST API route is reachable without logging in; the route name is unknown from the sources.","fix":null,"status":"open","published_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","triaged_at":"2026-11-11T06:27:07+00:00","updated_at":"2026-11-11T06:27:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce security plugin leaks every administrator's email address to anyone","impact":"low","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 exposes one of its REST API routes without access checks. An unauthenticated visitor can retrieve the email address of every administrator on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads all administrator email addresses","analyst_note":"Find the fixed plugin version and the exact REST route from the NVD entry or the plugin's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-123704.","how_to_check":"- Check the installed version of the Security For WooCommerce plugin in the WordPress admin plugin list; versions up to `1.0.16` are affected.\n- Test whether the REST API route is reachable without logging in; the route name is unknown from the sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Security For WooCommerce WordPress plugin version 1.0.16 or earlier are exposed, since the flawed REST route answers requests from anyone. Sites without this plugin, or running a fixed release, are not affected. The sources do not name the fixed version or the exact route.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4518,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123704':14A,17A '-2026':13A,16A '1.0.16':31B,63C 'access':40B,67C 'address':9A,49B,82C 'administr':6A,52B,85C 'allow':75C 'anyon':11A 'api':37B,73C 'check':41B 'cve':12A,15A 'email':8A,48B,81C 'everi':5A,51B,84C 'expos':32B 'host':21B 'leak':4A 'one':33B,69C 'packag':18B 'plugin':3A,29B,61C 'rest':36B,72C 'restrict':66C 'retriev':46B,79C 'rout':38B,74C 'secur':2A,25B,57C 'self':20B 'self-host':19B 'site':55B,88C 'unauthent':43B,76C 'user':77C 'visitor':44B 'without':39B 'woocommerc':1A,22B,27B,59C 'wordpress':23B,28B,60C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security For WooCommerce WordPress plugin version 1.0.16 or earlier are exposed, since the flawed REST route answers requests from anyone. Sites without this plugin, or running a fixed release, are not affected. The sources do not name the fixed version or the exact route.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123704':14A,17A '-2026':13A,16A 'address':9A 'administr':6A 'anyon':11A 'cve':12A,15A 'email':8A 'everi':5A 'leak':4A 'plugin':3A 'secur':2A 'woocommerc':1A","search_b":"'1.0.16':31B 'access':40B 'address':49B 'administr':52B 'api':37B 'check':41B 'email':48B 'everi':51B 'expos':32B 'host':21B 'one':33B 'packag':18B 'plugin':29B 'rest':36B 'retriev':46B 'rout':38B 'secur':25B 'self':20B 'self-host':19B 'site':55B 'unauthent':43B 'visitor':44B 'without':39B 'woocommerc':22B,27B 'wordpress':23B,28B","search_c":"'1.0.16':63C 'access':67C 'address':82C 'administr':85C 'allow':75C 'api':73C 'email':81C 'everi':84C 'one':69C 'plugin':61C 'rest':72C 'restrict':66C 'retriev':79C 'rout':74C 'secur':57C 'site':88C 'unauthent':76C 'user':77C 'woocommerc':59C 'wordpress':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123704","severity":null,"published_at":"2026-11-11T06:17:19+00:00","modified_at":"2026-11-11T06:17:19+00:00","first_seen_at":"2026-11-11T06:25:44+00:00","fetched_at":"2026-11-11T06:25:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}