Security For WooCommerce WordPress plugin: Unauthenticated login token disclosure
Summary
The Security For WooCommerce WordPress plugin through version 1.0.16 does not restrict access to several of its REST API routes. An unauthenticated attacker can generate login tokens for every user, including administrators, and retrieve them to log in as any of these users. The CVSS score of 9.8 is provided with the input but is not yet verified against NVD, and VulDB lists 7.3.
Affected
- Security For WooCommerce WordPress plugin, versions 0 through 1.0.16
- Vendor: Unknown
Fixed in
- VulDB advises updating to 1.0.17 or later; not confirmed by the vendor, WordPress.org or the WPScan advisory.
Workaround
- Deactivate the plugin until a verified fixed version is installed.
- Restrict access to the plugin's REST API routes at the web application firewall or reverse proxy. The affected routes are not confirmed.
- Restrict admin access by IP allowlist, as suggested by VulDB (unverified).
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- VulDB rates exploitation as easy, remote and without authentication.
- No public proof of concept confirmed.
Our recommendation
- Identify all WordPress sites running the plugin and deactivate or restrict it.
- Check for unexpected administrator accounts and recent logins, reset admin passwords and invalidate sessions, because tokens may already have been issued.
- Also check for rogue administrators related to other unauthenticated flaws in the same plugin versions 1.0.10 to 1.0.16.
- Update only once a vendor-confirmed fixed version is verified.
- Monitor the WPScan advisory and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record www.cve.org
- VulDB CVE-2026-123695 vuldb.com
- VulDB vulnerability 435643 vuldb.com
- OpenCVE CVE-2026-123695 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:20.
Original description (NVD)
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.