Export limit exceeded: 424937 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 24501 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123695 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 9.8 Critical |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators. | ||||
| CVE-2026-123696 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 7.5 High |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once. | ||||
| CVE-2026-123697 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 7.5 High |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available. | ||||
| CVE-2026-123698 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 5.3 Medium |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL. | ||||
| CVE-2026-123699 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 4.8 Medium |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site. | ||||
| CVE-2026-123700 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 7.5 High |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes. | ||||
| CVE-2026-123701 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 5.3 Medium |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall. | ||||
| CVE-2026-123702 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 6.5 Medium |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline. | ||||
| CVE-2026-123703 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 5.3 Medium |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request. | ||||
| CVE-2026-123704 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 5.3 Medium |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site. | ||||
| CVE-2026-123705 | 1 Wordpress-extensions | 1 Security For Woocommerce | 2026-11-12 | 5.3 Medium |
| The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For WooCommerce WordPress plugin through 1.0.16 and versions and the site administrator's email address. | ||||
Page 1 of 1.