Skip to content
Threat Feed
Subscribe

Product

Security for WooCommerce (<= 1.0.16)

3 briefs RSS
high advisory

Security For WooCommerce: Authentication bypass via improper access control (CVE-2026-123697)

The Security For WooCommerce WordPress plugin through version 1.0.16 fails to restrict access to user 2FA secrets, allowing unauthenticated remote attackers to retrieve 2FA information and bypass authentication.

Security For WooCommerce wordpress authentication-bypass webserver
1t 1c
high advisory

Security For WooCommerce: Unauthenticated 2FA reset vulnerability (CVE-2026-123696)

The Security For WooCommerce WordPress plugin through 1.0.16 contains an authentication bypass vulnerability that allows unauthenticated users to reset two-factor authentication for any user account.

Security For WooCommerce wordpress vulnerability authentication-bypass web-application
3t 1c
critical advisory

Security For WooCommerce: Unauthenticated authentication token generation (CVE-2026-123695)

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate and retrieve login tokens for any user, including administrators.

Security For WooCommerce
1c