CVE-2026-123703: Security For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logout
Published Nov 11, 2026
·Updated
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request.
Affected Software
1 affected component
Security For WooCommerce<=1.0.16
Event History
Nov 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated visitor can exploit it. No valid WordPress account or administrative access is required.
2
Which users can be forced to log out?
An attacker can end the login sessions of any user, including WordPress administrators. Repeating the request can keep targeted users logged out.
3
How can I tell whether my site is affected?
Sites using Security For WooCommerce version 1.0.16 or earlier are affected. Unexpected repeated logouts, particularly affecting administrators, may indicate exploitation.