{"id":"CVE-2026-123699","aliases":["EUVD-2026-123203","GHSA-q3rj-v8q7-qq42"],"status":"published","title":"Security For WooCommerce \u003c= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core Updates","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16,  and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00211,"percentile":0.11473,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-11T06:00:14Z","modified":"2026-11-11T12:32:45Z","products":[{"vendor":"unknown","product":"security for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123699"},{"url":"https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23"},{"url":"https://github.com/advisories/GHSA-q3rj-v8q7-qq42"}],"sources":{"cve":[{"id":"CVE-2026-123699","title":"Security For WooCommerce \u003c= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core Updates","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16,  and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.","status":"published","published":"2026-11-11T06:00:14.748Z","modified":"2026-11-11T11:31:45.079Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T12:57:43.416809Z"}],"euvd":[{"id":"EUVD-2026-123203","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16,  and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.","status":"published","published":"2026-11-11T06:00:14Z","modified":"2026-11-11T11:31:45Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-11T12:28:31.128551Z"}],"ghsa":[{"id":"GHSA-q3rj-v8q7-qq42","title":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is...","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16,  and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.","status":"published","published":"2026-11-11T06:32:41Z","modified":"2026-11-11T12:32:45Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-123699","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16,  and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site.","status":"published","published":"2026-11-11T06:17:19.01Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}