WordPress Plugin Vulnerabilities

Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Disclosure via REST API

Description

The plugin does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-security-for-woocommerce
No known fix

References

CVE
CVE-2026-123698

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Benjamin Kincses (Dextheking1)
Submitter
Benjamin Kincses (Dextheking1)
Verified
Yes
WPVDB ID
f13ecbe7-8abb-4736-be5c-fd38f402181c

Timeline

Publicly Published
2026-11-09 (about 21 hours ago)
Added
2026-11-09 (about 7 hours ago)
Last Updated
2026-11-09 (about 7 hours ago)

Other

Published
Title
Published
2022-02-28
Title
miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
Published
2025-01-24
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs < 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion
Published
2026-08-31
Title
Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk
Published
2024-06-20
Title
Hide Dashboard Notifications < 1.3.1 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification
Published
2026-10-29
Title
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership < 3.4.8 - Missing Authorization