CVE-2026-100109

Published: Nov 5, 2026Modified: Nov 5, 2026Deferred

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: contact@wpscan.com (Secondary)

Description

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/

Source: contact@wpscan.com

Timeline

No history available yet.