CVE-2026-100109
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability…
- Risk score
- 64/100
- CVSS
- 9.8 v3.0
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the si…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
Last activity 5 Nov 2026. Patch Forecast updates every hour.