Skip to content
Threat Feed
Subscribe
high advisory

Security For WooCommerce: Unauthenticated 2FA reset vulnerability (CVE-2026-123696)

The Security For WooCommerce WordPress plugin through 1.0.16 contains an authentication bypass vulnerability that allows unauthenticated users to reset two-factor authentication for any user account.

CVE search metadata

CVE search record: CVE-2026-123696. Severity: high. CVSS: 7.5. KEV: no. Product: Security For WooCommerce (<= 1.0.16). Brief: Security For WooCommerce: Unauthenticated 2FA reset vulnerability (CVE-2026-123696). Brief link: https://feed.craftedsignal.io/briefs/2026-11-security-woocommerce-2fa-reset-cve-2026-123696/

Triage facts

Revision 1
Applicability
Security For WooCommerce (<= 1.0.16)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 11, 14:00 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

The Security For WooCommerce plugin for WordPress (versions 1.0.16 and earlier) fails to verify authorization before executing two-factor authentication (2FA) reset requests. This flaw permits unauthenticated remote attackers to disable the second authentication factor for arbitrary user accounts or all accounts simultaneously, lowering the barrier for subsequent account takeover. No patch or fixed version has been provided in the current disclosure.

Impact

Successful exploitation allows an unauthenticated attacker to disable 2FA for any user, including administrative accounts. This effectively bypasses the multi-factor protection, leaving accounts vulnerable to password-based credential stuffing or brute-force attacks.

Recommendation

  • Review the "Security For WooCommerce" plugin settings and deactivate the 2FA features if alternative security controls are available.
  • Monitor WordPress access logs for unusual POST requests targeting 2FA configuration or reset endpoints associated with the plugin.
  • Audit user accounts for unexpected changes to 2FA status or authentication settings.
  • Restrict access to the site administrative dashboard using IP-based allowlisting at the web server or WAF level until a security patch is released.

Immediate actions

Disable 2FA reset functionality within the Security For WooCommerce plugin or switch to an alternative 2FA solution.

IT Operations 24h

Threat Hunt

Identify unauthenticated HTTP POST requests targeting WordPress endpoints associated with 2FA reset actions.

T1556 high medium confidence hunt now

Data: Web server access logs

Mitigations

Implement WAF rules to restrict access to WordPress plugin administrative URLs from untrusted IP addresses.

immediate SOC

CVE-2026-123696