Security For WooCommerce: Missing authorization allows forced updates

Summary

The Security For WooCommerce WordPress plugin up to and including version 1.0.16 does not check authorisation before running bulk updates. An unauthenticated attacker can force all pending plugin, theme and WordPress core updates to be installed on the affected site. The main risk is unexpected changes that could break the shop or cause downtime.

Affected

• Security For WooCommerce WordPress plugin, versions 0 to 1.0.16 (inclusive)

Fixed in

Unknown. No fixed version is published in the sources reviewed.

Workaround

• Restrict access to update functions where possible until a fix is available.
• Create a backup of the site before any update window.
• Check update logs for unexpected plugin or core changes.
• If the plugin is not business-critical, deactivate or remove it until a fixed version exists.

Exploitation

• Not known to be exploited in the wild.
• Not listed in the CISA KEV catalogue.
• No public exploit was found in the sources reviewed.

Our recommendation

• Check whether any WooCommerce site runs this plugin at version 1.0.16 or earlier.
• If it does, consider disabling the plugin until a fixed version is confirmed.
• Monitor logs for unexpected update activity, admin logins and 2FA changes.
• Re-check the WPScan and NVD entries regularly, as the data is still being updated.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• WPScan advisory wpscan.com
• OpenCVE CVE-2026-123699 app.opencve.io
• Researcher disclosure post (dev.to) dev.to
• OffSeq Radar threat entry CVE-2026-123699 radar.offseq.com
• Strix CVE-2026-123699 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:45.