Security For WooCommerce: Unauthenticated mass comment deletion (missing authorization)
Summary
The Security For WooCommerce WordPress plugin up to and including version 1.0.16 does not check authorization before running several comment cleanup actions. An unauthenticated remote attacker can permanently delete all comments on the site, including approved comments and WooCommerce order notes. No account or user interaction is required. The main impact is data loss; the NVD score is still pending.
Affected
- Security For WooCommerce WordPress plugin, versions 0 through 1.0.16
- Vendor and developer not confirmed in the sources; plugin name also reported as "ultimate security for woocommerce"
Fixed in
Unknown.
Workaround
- Restrict or disable the plugin's comment cleanup functionality if possible; this is difficult because the actions are unauthenticated.
- Deactivate and remove the plugin if it is not essential.
- Keep a current database backup, since deleted comments and order notes cannot be recovered from the site.
Exploitation
- CISA KEV: not listed.
- Threat Radar: not known to be exploited (weak, automated signal).
- No public proof of concept confirmed; the WPScan reference is tagged as exploit and was not verified.
- No in-the-wild exploitation reported in the sources reviewed.
- CISA SSVC: automatable yes, technical impact partial.
Our recommendation
- Check whether the plugin is installed on any WooCommerce or WordPress site; treat it as high-risk.
- Deactivate and remove the plugin unless it is essential.
- Back up the site before making changes.
- Check comment and order-note history after any suspected incident.
- Monitor the WordPress.org listing and the WPScan advisory for a fixed release.
- Prioritise CVE-2026-100109 (unauthenticated user creation, reported as critical) on the same plugin, which can enable full site takeover.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record CVE-2026-123700 www.cve.org
- OpenCVE CVE-2026-123700 app.opencve.io
- Threat Radar: CVE-2026-123700 radar.offseq.com
- Threat Radar: CWE-862 Security For WooCommerce radar.offseq.com
- Threat Radar: capability checks, 1.0.10 to 1.0.16 radar.offseq.com
- Strix AI: CVE-2026-123700 www.strix.ai
- Developer post by the finder dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:28.
Original description (NVD)
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.