WordPress Plugin Vulnerabilities

Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure

Description

The plugin does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-security-for-woocommerce
No known fix

References

CVE
CVE-2026-123695

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Aabideen Bangash
Submitter
Aabideen Bangash
Submitter website
https://www.linkedin.com/in/aabideen-bangash/
Verified
Yes
WPVDB ID
ad945f05-fc7e-4dad-8a37-b9a6a7acf7e0

Timeline

Publicly Published
2026-11-09 (about 3 days ago)
Added
2026-11-09 (about 2 days ago)
Last Updated
2026-11-11 (about 8 hours ago)

Other

Published
Title
Published
2024-07-04
Title
Book Your Travel < 8.18.19 - Authenticated (Subscriber+) Privilege Escalation
Published
2025-04-23
Title
Frontend Login and Registration Blocks < 1.0.9 - Subscriber+ Privilege Escalation via Password Reset
Published
2026-11-09
Title
Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token
Published
2026-08-20
Title
Abandoned Cart Pro for WooCommerce <= 10.4.0 - Unauthenticated Privilege Escalation
Published
2026-09-18
Title
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users