Security For WooCommerce: Unauthenticated authentication token generation (CVE-2026-123695)
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate and retrieve login tokens for any user, including administrators.
CVE search metadata
CVE search record: CVE-2026-123695. Severity: critical. CVSS: 9.8. KEV: no. Product: Security For WooCommerce (<= 1.0.16). Brief: Security For WooCommerce: Unauthenticated authentication token generation (CVE-2026-123695). Brief link: https://feed.craftedsignal.io/briefs/2026-11-auth-bypass-cve-2026-123695/
Triage facts
Revision 1- Applicability
- Security For WooCommerce (<= 1.0.16)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 14:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Security For WooCommerce WordPress plugin through 1.0.16 contains a vulnerability where several REST API routes are not restricted. This allows unauthenticated users to generate login tokens for every user and retrieve them, effectively allowing the attacker to log in as any user, including administrators.