Unknown Security For WooCommerce: critical vulnerability

Unknown Security For WooCommerce

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

Do this now

Check the vendor advisory for a fix and restrict access to the Security For WooCommerce plugin now.

Who should check: teams running WordPress

Still cooking for Security For WooCommerce.

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 14:17 UTC
Identifiers: CVE-2026-100109
CVSS: 9.8
Source: news
On the menu as: WordPress

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Unknown Security For WooCommerce: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: Unknown Security For WooCommerce
Ids: CVE-2026-100109

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

## Steps
1. Search the repo, its CI and infra config for Unknown Security For WooCommerce. If present, report the version in use and whether it's affected.
2. Security For WooCommerce 1.0.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Security For WooCommerce 1.0.x | not named in the CVE record | check the vendor advisory: https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/ | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-100109") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-100109 https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/
https://pwned.coffee/i/the-security-for-woocommerce-wordpress-plugin-from-1-0-1-cve-2026-100109

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Security For WooCommerce <= 1.0.16 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 6 Nov
The CVE record names no fix for one line; the vendor’s advisory may: wpscan.com
Score: CVSS 9.8 (critical). CVSS 3.0 9.8 (CNA WPScan) for CVE-2026-100109
Last checked: 6 Nov 2026, 15:18 UTC

Product	Affected	Fixed in	Source
Security For WooCommerce	<= 1.0.16	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 6 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee