Security For WooCommerce: Missing authorization allows unauthenticated user logout
Summary
The Security For WooCommerce WordPress plugin up to and including version 1.0.16 does not check whether the requester is authorised before ending user login sessions. An unauthenticated visitor can log out any user, including administrators, and keep them logged out by repeating the request. The impact is limited to availability, but it can disrupt shop operations.
Affected
- Security For WooCommerce WordPress plugin, versions 0 through 1.0.16
- Vendor: Unknown
Fixed in
Unknown. No vendor advisory or changelog confirming a fixed version was found. Some sources mention version 1.0.17, but this could not be verified.
Workaround
- Deactivate and remove the plugin if it is not required.
- Restrict access to the plugin's logout functionality or monitor for unusual logout activity.
- Rate limiting on the affected endpoint may be used as a stopgap, but it does not fully prevent disruption.
- No vendor-sanctioned mitigation is known.
Exploitation
- Attack requires no authentication or user interaction and is network-reachable.
- Not listed in CISA KEV.
- No confirmed public proof-of-concept exploit code.
- No confirmed evidence of exploitation in the wild.
- CISA SSVC: automatable yes, technical impact partial.
Our recommendation
- Check whether the plugin is installed on any WordPress/WooCommerce site and at which version.
- If installed and not essential, deactivate and remove it and treat it as unpatched until a vendor fix is confirmed.
- Check for unexpected administrator accounts, as sibling vulnerabilities in the same plugin (for example CVE-2026-100109) may allow account creation.
- Monitor the NVD entry and the WPScan advisory for a confirmed fixed version before re-enabling.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-123703 www.cve.org
- WPScan advisory wpscan.com
- VulDB CVE-2026-123703 vuldb.com
- OffSeq radar CVE-2026-123703 radar.offseq.com
- OpenCVE CVE-2026-123703 app.opencve.io
- OffSeq radar: sibling capability checks flaw (CVE-2026-100109) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:02.
Original description (NVD)
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.