---
id: "CVE-2026-123704"
page: "https://infrastack.ai/live/CVE-2026-123704"
kind: "vulnerability"
aliases: ["CVE-2026-123704"]
title: "WooCommerce security plugin leaks every administrator's email address to anyone"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:19+00:00"
first_seen_at: "2026-11-11T06:25:44+00:00"
updated_at: "2026-11-11T06:27:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123704", "first_seen_at": "2026-11-11T06:25:44+00:00"}]
exploit_sources: []
---

# WooCommerce security plugin leaks every administrator's email address to anyone

Link for people: https://infrastack.ai/live/CVE-2026-123704 (this .md is for agents)

The Security For WooCommerce WordPress plugin through 1.0.16 exposes one of its REST API routes without access checks. An unauthenticated visitor can retrieve the email address of every administrator on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Security For WooCommerce plugin in the WordPress admin plugin list; versions up to `1.0.16` are affected.
- Test whether the REST API route is reachable without logging in; the route name is unknown from the sources.

## Timeline

- 2026-11-11T06:25:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123704

## From the sources

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_