PT-2026-137420
CVE-2026-100109
·
Published
2026-11-05
·
Updated
2026-11-06
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Security For WooCommerce versions 1.0.10 through 1.0.16
Description
The plugin fails to perform capability checks when creating users through an action accessible to unauthenticated visitors. This allows an attacker to specify the role of the new account, enabling the creation of administrator accounts and complete site takeover.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾