{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asecurity_for_woocommerce_projectsecurity_for_woocommercewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:security_for_woocommerce_project:security_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-123697"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Security For WooCommerce (\u003c= 1.0.16)"],"_cs_severities":["high"],"_cs_tags":["wordpress","authentication-bypass","webserver"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Security For WooCommerce WordPress plugin contains a vulnerability (CVE-2026-123697) where the application does not properly restrict who can request a user's two-factor authentication (2FA) code or secret. An unauthenticated attacker can retrieve this sensitive information for any user account, effectively allowing them to bypass the second-factor authentication mechanism.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to obtain 2FA secrets or one-time passwords for any registered user on the site, potentially leading to unauthorized account takeovers and bypass of existing security controls.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the \u0026quot;Security For WooCommerce\u0026quot; plugin.\u003c/li\u003e\n\u003cli\u003eUpgrade to a version beyond 1.0.16 immediately when a patch is available.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized or unexpected requests to 2FA generation endpoints associated with this plugin.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T14:00:33Z","date_published":"2026-11-11T14:00:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-woocommerce-auth-bypass-cve-2026-123697/","summary":"The Security For WooCommerce WordPress plugin through version 1.0.16 fails to restrict access to user 2FA secrets, allowing unauthenticated remote attackers to retrieve 2FA information and bypass authentication.","title":"Security For WooCommerce: Authentication bypass via improper access control (CVE-2026-123697)","url":"https://feed.craftedsignal.io/briefs/2026-11-woocommerce-auth-bypass-cve-2026-123697/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:security_for_woocommerce_project:security_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-123696"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Security For WooCommerce (\u003c= 1.0.16)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","authentication-bypass","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Security For WooCommerce plugin for WordPress (versions 1.0.16 and earlier) fails to verify authorization before executing two-factor authentication (2FA) reset requests. This flaw permits unauthenticated remote attackers to disable the second authentication factor for arbitrary user accounts or all accounts simultaneously, lowering the barrier for subsequent account takeover. No patch or fixed version has been provided in the current disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to disable 2FA for any user, including administrative accounts. This effectively bypasses the multi-factor protection, leaving accounts vulnerable to password-based credential stuffing or brute-force attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReview the \u0026quot;Security For WooCommerce\u0026quot; plugin settings and deactivate the 2FA features if alternative security controls are available.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress access logs for unusual POST requests targeting 2FA configuration or reset endpoints associated with the plugin.\u003c/li\u003e\n\u003cli\u003eAudit user accounts for unexpected changes to 2FA status or authentication settings.\u003c/li\u003e\n\u003cli\u003eRestrict access to the site administrative dashboard using IP-based allowlisting at the web server or WAF level until a security patch is released.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T14:00:20Z","date_published":"2026-11-11T14:00:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-security-woocommerce-2fa-reset-cve-2026-123696/","summary":"The Security For WooCommerce WordPress plugin through 1.0.16 contains an authentication bypass vulnerability that allows unauthenticated users to reset two-factor authentication for any user account.","title":"Security For WooCommerce: Unauthenticated 2FA reset vulnerability (CVE-2026-123696)","url":"https://feed.craftedsignal.io/briefs/2026-11-security-woocommerce-2fa-reset-cve-2026-123696/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:security_for_woocommerce_project:security_for_woocommerce:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}