CVE-2026-123695: Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites running Security For WooCommerce version 1.0.16 or earlier are affected. The issue is exposed through REST API routes that do not require authentication.
What does an attacker need to exploit this issue?
An attacker does not need an existing account or authentication. They can generate and retrieve login tokens for users through the affected REST API routes.
How severe is successful exploitation?
An attacker can log in as any user, including an administrator. This can result in complete administrative access to the affected WordPress site.
Is there public exploit information available?
Yes. The vulnerability is flagged as having a proof of concept.