Security For WooCommerce: unauthenticated login as any user (CVE-2026-123695)
The Security For WooCommerce WordPress plugin does not restrict access to several of its REST API routes. An unauthenticated visitor can generate login tokens for every user, retrieve them, and log in as any user, including administrators. The source lists a CVSS score of 9.8.
Checked in Shield: no
Who is affected
WordPress sites running the Security For WooCommerce plugin version 1.0.16 or earlier (through 1.0.16).
How to check
In the WordPress admin, open Plugins and find Security For WooCommerce. If the version is 1.0.16 or lower, the site is affected. Also review the administrator list and recent logins for anything unfamiliar.
How to fix
The source does not name a fixed version. Check whether a plugin update is available. Until then, consider deactivating the plugin and resetting administrator passwords if you see suspicious logins.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
A fixed version and whether the issue is exploited in the wild are not disclosed yet. Source: NVD.
