by Kastro
Paper/Archive/CVE-2026-100109

CVE-2026-100109

Unknown Security For WooCommerce — Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

CVSS 9.8
critical.is priorityof 100
29
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

Affected

ProductAffectedFixed inSource
Security For WooCommerce1.0.10 – 1.0.16–CNA

Scores by source

WPScan (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

exploitwpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c