CVE-2026-123698: Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Disclosure via REST API
Published Nov 11, 2026
·Updated
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL.
Affected Software
1 affected component
Security For WooCommerce<=1.0.16
Event History
Nov 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated remote user who can reach the affected WordPress site's REST API route can retrieve the plugin's settings. No login or prior access is required.
2
What information may be exposed?
The exposed settings can include configured secret keys and the hidden login URL.
3
Which installations are affected?
Security For WooCommerce versions through 1.0.16 are affected. The issue is in a REST API route that does not restrict access, so installations with the plugin and reachable REST API exposure are at risk.