CVE-2026-100109

CriticalCVSS 9.8/10Last modified Nov 5, 2026

Description

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
UnknownSecurity For WooCommerce>= 1.0.10, <= 1.0.16

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-100113.1Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proCVE-2026-1001117.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-1001127.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-1001137.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-1001147.5CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker CVE-2026-1001157.5CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker CVE-2026-1001165.9CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An aCVE-2026-1001177.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-1001187.5CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An aCVE-2026-1001197.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-100128.3Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentCVE-2026-1001207.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke
CVE-2026-100109: Critical severity, CVSS 9.8 | Vulnix