Unrated severityNVD Advisory· Published Nov 11, 2026
CVE-2026-123695
CVE-2026-123695
Description
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.
Affected products
2<=1.0.16+ 1 more
- (no CPE)range: <=1.0.16
- (no CPE)range: <=1.0.16
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.