CVE-2026-100109: Privileged Accounts via Security For WooCommerce
This text was generated using artificial intelligence (AI).WPScan documents with CVE-2026-100109 a vulnerability in the WordPress plugin Security For WooCommerce. Affected are versions 1.0.10 to 1.0.16. The vulnerability is categorized as CVSS 9.8 rated and classified in the category CWE-862: Missing Authorization .
The documented function can be accessed via an unauthenticated HTTP request. The role of a newly created user account can be specified. This could allow the creation of an account with administrative rights and the takeover of an affected website.
According to WPScan, there is a lack of permission check in the WordPress action usfw_create_temporary_user . The function is accessible to unauthenticated visitors and allows the caller to set the role of the new account being created.
If a privileged role like Administrator is specified, an attacker can create an account with extensive rights. The documented attack vector requires neither an existing user account nor user interaction.
The published CVSS score of 9.8 describes a network-based attack with low complexity, with no required permissions and no user interaction. Confidentiality, integrity, and availability are rated high in the CVSS entry.
At the time of publication, no patched version of the plugin is known. According to WPScan, no active exploitation is currently documented.
Assessing impact and checking accounts
Organizations should first determine whether Security For WooCommerce in versions 1.0.10 to 1.0.16 is in use on their WordPress instances. Instances where the affected function is accessible via HTTP should be prioritized.
Checking for unknown administrator accounts is a separate task. Already created accounts may persist even if the plugin is deactivated or a fix is later applied.
Recommended actions are:
Record the plugin inventory and deployed versions on WordPress instances.
Check whether unknown administrator accounts or other privileged users have been created.
Prioritize affected systems and implement appropriate mitigation measures.
Restrict access to the affected action using a WAF or firewall rule.
Deactivate the plugin until a vendor fix is available.
Update to a fixed version after it’s provided by the vendor.
A regularly maintained WordPress plugin inventory also supports the checking of known CVEs on used components.
WooCommerce is one of the most widely used e-commerce platforms in Germany, Austria, and Switzerland. Operators in Germany and Austria who fall under NIS-2 or the Austrian NISG should check whether a compromise via this vulnerability triggers a reporting obligation. If personal data of EU citizens is affected, there may be a reporting obligation under Art. 33 GDPR to the relevant data protection authority (72-hour deadline). For Swiss organizations, the revised Information Security Act (ISG) applies with reporting obligations to the BACS.
Security For WooCommerce operates as a server-side component under a customer domain. According to the existing technical classification, instances may be externally recognizable via plugin paths, HTTP headers, or response signatures.
LocateRisk can make externally accessible web applications and systems visible under customer domains. This supports the assignment of publicly accessible WordPress instances for technical examination. However, an externally recognized instance does not automatically confirm the specifically used vulnerable version. Therefore, checking the plugin inventory and the deployed version remains necessary for CVE-2026-100109.
When operation, maintenance, or plugin management is handled by third parties, it should also be clarified who is responsible for updates, account audits, and documented mitigation measures. Continuous vulnerability and vendor risk monitoring can incorporate these tasks into recurring review processes.
Am I affected?
This affects Security For WooCommerce in the versions mentioned above. If you want to know whether Security For WooCommerce is even visible in your own externally accessible infrastructure, you can use the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
The vulnerability allows unauthenticated attackers to create a WordPress account with a freely selectable role — including administrator — due to a missing authorization check. This enables complete takeover of the affected website without the need for an existing account or user interaction.
This affects versions 1.0.10 to 1.0.16 of the plugin Security For WooCommerce. At the time of publication, no fixed version is available. Operators should deactivate the plugin until a fix is provided.
The plugin should be disabled until a fix is available. Additionally, it is advisable to restrict access to the affected WordPress action through a WAF or firewall rule, as well as to conduct a targeted review of existing administrator accounts for unknown entries.
Status: November 05, 2026. This article serves general informational purposes and is not legal, security, or action advice for individual cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always decisive. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-100109
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français