CVE WATCH / VULNERABILITY DETAIL
CVE-2026-100109
CRITICALCVSS 9.8NVD feed
Published 5 November 2026 · tracked since 5 November 2026
Description
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts a
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-92895 HIGH 8.1
- CVE-2026-116624 HIGH 8.8
- CVE-2026-114630 CRITICAL 9.1
- CVE-2026-107622 CRITICAL 9.8
- CVE-2026-104010 HIGH 7.5
- CVE-2026-103479 HIGH 7.6
- CVE-2026-123325 HIGH 7.1
- CVE-2026-123321 HIGH 7.8
- CVE-2026-123306 HIGH 7.4
- CVE-2026-123304 HIGH 7.8