CVE-2026-123695

Name of the Vulnerable Software and Affected Versions Security For WooCommerce versions prior to 1.0.17

Description The plugin fails to restrict access to several REST API routes, which allows unauthenticated users to generate and retrieve login tokens for any account. This flaw enables an attacker to perform privilege escalation and log in as any user, including those with administrator privileges.

Recommendations Deactivate the plugin. At the moment, there is no information about a newer version that contains a fix for this vulnerability.