Security For WooCommerce: Authentication bypass via improper access control (CVE-2026-123697)
The Security For WooCommerce WordPress plugin through version 1.0.16 fails to restrict access to user 2FA secrets, allowing unauthenticated remote attackers to retrieve 2FA information and bypass authentication.
CVE search metadata
CVE search record: CVE-2026-123697. Severity: high. CVSS: 7.5. KEV: no. Product: Security For WooCommerce (<= 1.0.16). Brief: Security For WooCommerce: Authentication bypass via improper access control (CVE-2026-123697). Brief link: https://feed.craftedsignal.io/briefs/2026-11-woocommerce-auth-bypass-cve-2026-123697/
Triage facts
Revision 1- Applicability
- Security For WooCommerce (<= 1.0.16)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 14:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The Security For WooCommerce WordPress plugin contains a vulnerability (CVE-2026-123697) where the application does not properly restrict who can request a user's two-factor authentication (2FA) code or secret. An unauthenticated attacker can retrieve this sensitive information for any user account, effectively allowing them to bypass the second-factor authentication mechanism.
Impact
Successful exploitation allows unauthenticated attackers to obtain 2FA secrets or one-time passwords for any registered user on the site, potentially leading to unauthorized account takeovers and bypass of existing security controls.
Recommendation
- Inventory all WordPress instances running the "Security For WooCommerce" plugin.
- Upgrade to a version beyond 1.0.16 immediately when a patch is available.
- Audit logs for unauthorized or unexpected requests to 2FA generation endpoints associated with this plugin.
Immediate actions
Identify and inventory systems utilizing the Security For WooCommerce plugin version 1.0.16 or earlier
Threat Hunt
Monitor web server access logs for anomalous, high-frequency, or unauthenticated requests to plugin-specific API endpoints related to 2FA secret generation or retrieval
Data: Web server access logs (e.g., Apache, Nginx, or IIS)
Mitigations
Upgrade or patch the Security For WooCommerce plugin beyond version 1.0.16
CVE-2026-123697