CVE-2026-123695

CriticalCVSS 9.8/10Last modified Nov 12, 2026

Description

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1236967.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor autCVE-2026-1236977.5The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factoCVE-2026-1236985.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticateCVE-2026-1236994.8The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security FoCVE-2026-12372.1Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to upCVE-2026-123707.6ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a ServerCVE-2026-1237007.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its cCVE-2026-1237015.3The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowingCVE-2026-1237026.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret CVE-2026-1237035.3The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login seCVE-2026-1237045.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticateCVE-2026-1237055.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticate
CVE-2026-123695: Critical severity, CVSS 9.8 | Vulnix