CVE-2026-123705 · Package
NO FIX YET
The Security For WooCommerce WordPress plugin, through version 1.0.16, exposes one REST API route without any access check. An unauthenticated visitor can retrieve a detailed report of the server, PHP and WordPress configuration, the installed plugin versions, and the site administrator's email address.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site running the Security For WooCommerce plugin at version 1.0.16 or earlier is exposed, since the flawed REST route needs no login. Sites that do not have this plugin installed can skip it. The sources do not say whether a non-default setting is needed.
Not affected if plugin-not-installed
Who cares self-hosted, woocommerce, wordpress
wp plugin get <plugin-slug> --field=version./wp-json/ on the site and checking whether a route from the plugin is listed without authentication.No fix yet, per the sources.
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For WooCommerce WordPress plugin through 1.0.16 and versions and the site administrator's email address.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.