CVE-2026-123696

HighCVSS 7.5/10Last modified Nov 12, 2026

Description

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
UnknownSecurity For WooCommerce<= 1.0.16

References

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1236977.5The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factoCVE-2026-1236985.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticateCVE-2026-1236994.8The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security FoCVE-2026-12372.1Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to upCVE-2026-123707.6ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a ServerCVE-2026-1237007.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its cCVE-2026-1237015.3The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowingCVE-2026-1237026.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret CVE-2026-1237035.3The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login seCVE-2026-1237045.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticateCVE-2026-1237055.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticateCVE-2026-1237109.8A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present tha
CVE-2026-123696: High severity, CVSS 7.5 | Vulnix