Security For WooCommerce WordPress plugin: Unauthenticated information disclosure via REST API
Summary
The Security For WooCommerce WordPress plugin up to and including version 1.0.16 does not restrict access to one of its REST API routes. An unauthenticated attacker can retrieve a report with server, PHP and WordPress configuration, installed plugin versions and the site administrator's email address. The disclosure does not by itself give access to the site, but it helps attackers plan targeted attacks such as phishing against the administrator.
Affected
- Security For WooCommerce WordPress plugin, all versions through 1.0.16
- Vendor: Unknown
- Plugin name in the researcher's post differs ("Ultimate Security for WooCommerce"), to be verified against the wordpress.org listing
Fixed in
Unknown. No vendor advisory or patched release found.
Workaround
- Deactivate the plugin if it is not essential.
- Restrict access to the affected REST route with custom access controls until a fix exists (generic guidance, not a vendor statement).
- Check the WPScan advisory for the specific route before writing any access rule.
Exploitation
- CISA KEV: not listed.
- OffSeq: not known to be exploited.
- No public exploit or proof of concept found.
- Exploitation is simple because the route requires no authentication.
Our recommendation
- Identify all sites running this plugin at version 1.0.16 or earlier.
- Deactivate the plugin where it is not essential.
- Check the same installation for related CVEs CVE-2026-123695 and CVE-2026-123698, which are more serious.
- Review server or WAF logs for requests to the plugin's REST namespace, and rotate any secrets the plugin stores if exposure is suspected.
- Check the WPScan advisory and wordpress.org listing regularly for a fixed release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-123705 www.cve.org
- WPScan advisory wpscan.com
- OpenCVE CVE-2026-123705 app.opencve.io
- OffSeq Radar threat entry radar.offseq.com
- VulDB CVE-2026-123695 (related) vuldb.com
- VulDB CVE-2026-123698 (related) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:02.
Original description (NVD)
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For WooCommerce WordPress plugin through 1.0.16 and versions and the site administrator's email address.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.