CVE-2026-123700: Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion

Q: Who can exploit this issue?

An unauthenticated user can exploit the affected comment cleanup actions because the plugin does not verify that the requester is authorized.

Q: What data can be deleted?

An attacker can permanently delete all site comments, including approved comments and WooCommerce order notes.

Q: Are WooCommerce order records at risk?

WooCommerce order notes are included in the comments that can be permanently deleted. The provided information does not indicate that other order data is affected.

Published Nov 11, 2026

Updated

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes.

Affected Software

1 affected component

WordPress Security For WooCommerce<=1.0.16

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated user can exploit the affected comment cleanup actions because the plugin does not verify that the requester is authorized.

What data can be deleted?

An attacker can permanently delete all site comments, including approved comments and WooCommerce order notes.

Are WooCommerce order records at risk?

WooCommerce order notes are included in the comments that can be permanently deleted. The provided information does not indicate that other order data is affected.

CVE-2026-123700: Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What data can be deleted?

Are WooCommerce order records at risk?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data can be deleted?

Are WooCommerce order records at risk?