CVE-2026-100109: Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
Event History
Frequently Asked Questions
Which sites are exposed?
WordPress sites using Security For WooCommerce versions 1.0.10 through 1.0.16 are affected. Exploitation is available to unauthenticated visitors through the user-creation action.
What does an attacker need to exploit this issue?
The attacker does not need an existing account, credentials, or user interaction. They can invoke the exposed action and select the role assigned to the newly created account.
What is the practical impact of successful exploitation?
An attacker can create an administrator account and take over the WordPress site. This can compromise confidentiality, integrity, and availability.
How can I check whether my site may have been compromised?
Review WordPress user accounts for unexpected newly created administrator users. Also check whether the installed Security For WooCommerce version falls within 1.0.10 to 1.0.16.