WordPress Plugin Vulnerabilities

Security For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logout

Description

The plugin does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-security-for-woocommerce
No known fix

References

CVE
CVE-2026-123703

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Benjamin Kincses (Dextheking1)
Submitter
Benjamin Kincses (Dextheking1)
Verified
Yes
WPVDB ID
6b255385-26ae-416c-8c2d-a673508aa212

Timeline

Publicly Published
2026-11-09 (about 21 hours ago)
Added
2026-11-09 (about 7 hours ago)
Last Updated
2026-11-09 (about 7 hours ago)

Other

Published
Title
Published
2026-09-23
Title
MailerLite – Signup forms (official) < 1.7.22 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
Published
2024-01-05
Title
Booster Plus for WooCommerce < 7.1.3 - Missing Authorization to Arbitrary Options Disclosure
Published
2026-05-27
Title
3D Viewer < 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint
Published
2024-09-25
Title
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce < 5.7.35 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
Published
2026-07-15
Title
Themify Builder < 7.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action