WordPress Plugin Vulnerabilities

Security For WooCommerce <= 1.0.16 - Unauthenticated Administrator Email Address Disclosure

Description

The plugin does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-security-for-woocommerce
No known fix

References

CVE
CVE-2026-123704

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Benjamin Kincses (Dextheking1)
Submitter
Benjamin Kincses (Dextheking1)
Verified
Yes
WPVDB ID
b7e8fa76-32c0-48ea-a685-2a75ffe94cd1

Timeline

Publicly Published
2026-11-09 (about 21 hours ago)
Added
2026-11-09 (about 7 hours ago)
Last Updated
2026-11-09 (about 7 hours ago)

Other

Published
Title
Published
2026-08-19
Title
Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
Published
2026-10-06
Title
SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token
Published
2025-01-17
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.9.2 - Information Exposure
Published
2022-09-22
Title
Customer Reviews for WooCommerce < 5.3.6 - Unauthenticated Sensitive Information Disclosure
Published
2023-12-29
Title
Image Source Control < 2.17.1 - Sensitive Information Exposure via Log File