Security For WooCommerce WordPress plugin: Missing authorization in wp-config key reset
Summary
The Security For WooCommerce WordPress plugin through version 1.0.16 does not check whether a requester is authorised before regenerating the secret keys and salts in wp-config.php. An unauthenticated attacker can send a request that logs out all users of the site. On servers that cannot reach the WordPress.org API, the configuration file can be corrupted, which takes the whole site offline.
Affected
- Security For WooCommerce WordPress plugin, all versions through 1.0.16
- Vendor and version range as listed in the CVE record; the developer is unknown.
Fixed in
Unknown. No vendor advisory or changelog entry confirming a fixed version was found. An unverified VulDB page mentions version 1.0.17, which has not been confirmed.
Workaround
- No vendor-confirmed workaround known.
- Deactivate and remove the plugin if it is not essential.
- Back up wp-config.php now.
- Restrict access to the WordPress admin area by IP address where feasible; this may not cover the vulnerable endpoint.
Exploitation
- No evidence of exploitation in the wild found.
- Public proof of concept: not confirmed.
- CISA SSVC: Exploitation none, not automatable, partial technical impact.
Our recommendation
- Check whether any site runs Security For WooCommerce version 1.0.16 or earlier and treat it as urgent.
- Remove the plugin if it is not essential; otherwise restrict exposure of the site and monitor it.
- Back up wp-config.php and verify it is intact after any unexpected log-out.
- Check for unauthorised administrator accounts and sudden session loss.
- Watch the WordPress.org changelog and the WPScan entry for a fixed version and install it once confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- CVE Record CVE-2026-123702 www.cve.org
- OpenCVE CVE-2026-123702 app.opencve.io
- VulDB CVE-2026-123702 vuldb.com
- OffSeq Radar CVE-2026-123702 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:43.
Original description (NVD)
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.