CVE-2026-100109

Full vulnerability record from the local CVENow database.

Description

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

Severity

CRITICAL

CVSS score

9.8 (v3.0)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 08:17:01.870000

Last modified

2026-11-05 08:17:01.870000

View original CVE JSON

{
  "id": "CVE-2026-100109",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T08:17:01.870",
  "lastModified": "2026-11-05T08:17:01.870",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Security For WooCommerce",
          "defaultStatus": "unknown",
          "collectionURL": "https://wordpress.org/plugins",
          "versions": [
            {
              "version": "1.0.10",
              "lessThanOrEqual": "1.0.16",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/",
      "source": "[email protected]"
    }
  ]
}