CVE-2026-123702

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1237035.3The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login se CVE-2026-1237045.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticate CVE-2026-1237055.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticate CVE-2026-1237109.8A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present tha CVE-2026-123711The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attack CVE-2026-1237178.8OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able CVE-2026-123723.7A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.vali CVE-2026-123746.4Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Clie CVE-2026-1237462.3The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method CVE-2026-1237477.3A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion CVE-2026-1237484.3A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of t CVE-2026-123759.8The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordP