CVE-2026-123704: Security For WooCommerce <= 1.0.16 - Unauthenticated Administrator Email Address Disclosure
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user who can reach the affected site's REST API route can retrieve the email address of every administrator. No login is required.
Which installations are affected?
Security For WooCommerce versions through 1.0.16 are affected. The provided information does not identify any configuration prerequisite, so sites running an affected version should be treated as exposed.
How can I determine whether my site has been exposed?
The available information confirms that administrator email addresses can be retrieved through an unrestricted REST API route, but it does not provide request paths, logging indicators, or other detection details.