{"id":"CVE-2026-123704","aliases":["EUVD-2026-123208","GHSA-x628-ffjp-cx7j"],"status":"published","title":"Security For WooCommerce \u003c= 1.0.16 - Unauthenticated Administrator Email Address Disclosure","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00271,"percentile":0.19575,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-11-11T06:00:15Z","modified":"2026-11-11T12:32:45Z","products":[{"vendor":"unknown","product":"security for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123704"},{"url":"https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1"},{"url":"https://github.com/advisories/GHSA-x628-ffjp-cx7j"}],"sources":{"cve":[{"id":"CVE-2026-123704","title":"Security For WooCommerce \u003c= 1.0.16 - Unauthenticated Administrator Email Address Disclosure","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","status":"published","published":"2026-11-11T06:00:15.626Z","modified":"2026-11-11T11:30:22.164Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-11T12:57:44.071307Z"}],"euvd":[{"id":"EUVD-2026-123208","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","status":"published","published":"2026-11-11T06:00:15Z","modified":"2026-11-11T11:30:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-11T12:28:31.128551Z"}],"ghsa":[{"id":"GHSA-x628-ffjp-cx7j","title":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of...","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","status":"published","published":"2026-11-11T06:32:41Z","modified":"2026-11-11T12:32:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-123704","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","status":"published","published":"2026-11-11T06:17:19.703Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}