CVE-2026-123699: Security For WooCommerce <= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core Updates
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated user can trigger it remotely; no authorization is checked before the bulk update action runs.
What updates can an attacker force the site to install?
The issue can force installation of every pending update, including WordPress core updates and pending plugin and theme updates.
Are sites affected if no updates are pending?
The described impact depends on pending updates being available. The vulnerability forces pending updates to install; the data does not indicate any separate impact when none are pending.
How can I determine whether my site is affected?
Check whether Security For WooCommerce is installed and whether its version is 1.0.16 or earlier. Sites with pending WordPress core, plugin, or theme updates are exposed to forced installation of those updates.