CVE-2026-123695

Published 11 November 2026 · tracked since 12 November 2026

Description

The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-120151 HIGH 8.8
• CVE-2026-120150 HIGH 8.8
• CVE-2026-120149 HIGH 8.8
• CVE-2026-120147 HIGH 8.8
• CVE-2026-120145 HIGH 8.8
• CVE-2026-120144 HIGH 8.8
• CVE-2026-120143 HIGH 8.8
• CVE-2026-120142 HIGH 8.8
• CVE-2026-120141 HIGH 8.8
• CVE-2026-120139 HIGH 8.8

→ Open the live CVE board · all tools