CVE-2026-123696: Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Security For WooCommerce version 1.0.16 or earlier are affected. An attacker does not need to authenticate to target accounts.
What can an attacker do with this vulnerability?
An unauthenticated attacker can reset two-factor authentication enrolment for any individual account or for all accounts at once. This removes the second-factor requirement but does not, based on the available information, provide account credentials.
Is there evidence that exploitation is practical?
The vulnerability is flagged as having a proof of concept, indicating that exploit details or demonstration code are available.