CVE-2026-123697: Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure

Q: Which sites are exposed to two-factor bypass?

Sites using Security For WooCommerce version 1.0.16 or earlier are affected if the plugin's one-time password library is available. In that condition, an unauthenticated attacker can obtain a current two-factor code or secret for any account.

Q: Does exploitation require an existing account or authentication?

No. The issue allows unauthenticated users to request a user's current two-factor code or two-factor secret, including for arbitrary accounts.

Q: How can I determine whether my site is affected?

Check whether Security For WooCommerce is installed at version 1.0.16 or earlier and whether its one-time password library is available. Those conditions indicate the described two-factor disclosure and bypass risk.

Published Nov 11, 2026

Updated

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.

Affected Software

1 affected component

Security For WooCommerce<=1.0.16

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed to two-factor bypass?

Sites using Security For WooCommerce version 1.0.16 or earlier are affected if the plugin's one-time password library is available. In that condition, an unauthenticated attacker can obtain a current two-factor code or secret for any account.

Does exploitation require an existing account or authentication?

No. The issue allows unauthenticated users to request a user's current two-factor code or two-factor secret, including for arbitrary accounts.

How can I determine whether my site is affected?

Check whether Security For WooCommerce is installed at version 1.0.16 or earlier and whether its one-time password library is available. Those conditions indicate the described two-factor disclosure and bypass risk.

CVE-2026-123697: Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure

Affected Software

Event History

Frequently Asked Questions

Which sites are exposed to two-factor bypass?

Does exploitation require an existing account or authentication?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to two-factor bypass?

Does exploitation require an existing account or authentication?

How can I determine whether my site is affected?