Dashboard / CVE-2026-123702

CVE-2026-123702

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 63/100
Published: 2026-11-11 Modified: 2026-11-12 First seen: 2026-11-11 Status: active

Attack Surface

Network No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: None
I: Low
A: High

Description

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown Security For WooCommerce 0
Unknown Security For WooCommerce 0

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS — Exploitation Probability

0.24%
Raw Score 0.002360
Percentile 14.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00236
2026-11-12
0.00236

Intelligence Sources

mitre ref →
nvd ref →

External Links