WordPress Plugin Vulnerabilities

Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Reset

Description

The plugin does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-security-for-woocommerce
No known fix

References

CVE
CVE-2026-123701

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Benjamin Kincses (Dextheking1)
Submitter
Benjamin Kincses (Dextheking1)
Verified
Yes
WPVDB ID
9d65f64f-b9d5-488d-a81d-4013a1b1fc9e

Timeline

Publicly Published
2026-11-09 (about 21 hours ago)
Added
2026-11-09 (about 7 hours ago)
Last Updated
2026-11-09 (about 7 hours ago)

Other

Published
Title
Published
2025-08-21
Title
Spacious < 1.9.12 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import
Published
2022-08-25
Title
Accommodation System <= 1.0.1 - Subscriber+ Unauthorised Actions
Published
2023-10-18
Title
Social proof testimonials and reviews by Repuso < 5.00 - Missing Authorization
Published
2025-06-19
Title
eDS Responsive Menu <= 1.2 - Missing Authorization
Published
2026-02-18
Title
Elegant Pink < 1.3.4 - Missing Authorization