{"id":"CVE-2026-100109","published":"2026-11-05T08:17:01.870","lastModified":"2026-11-05T08:17:01.870","description":"The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Security For WooCommerce WordPress plugin (versions 1.0.10–1.0.16) exposes an unauthenticated endpoint that allows anyone to create new users without capability checks and with arbitrary role selection, enabling attackers to register as administrators.","exploitability":"Trivial to exploit; requires only sending a single HTTP request to the vulnerable action endpoint without authentication or authorization.","blast_radius":"Successful exploitation grants full administrative control of the WordPress site, enabling complete data exfiltration, malware deployment, or site defacement.","remediation":"Upgrade to Security For WooCommerce plugin version 1.0.17 or later, which patches the missing capability checks and role restriction.","detection":"Look for POST requests to the plugin's user creation endpoint (e.g., /wp-admin/admin-ajax.php?action=wc_security_create_user) from unauthenticated IP addresses with a 'role' parameter set to 'administrator' in the request body; such requests should not succeed without proper authentication and permissions.","tags":["auth-bypass","privilege-escalation","wordpress","unauthenticated-access"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:46:47.598Z"}}