The Security For WooCommerce WordPress plugin (versions 1.0.10 through 1.0.16) lacks capability checks when creating users through an action accessible to unauthenticated visitors. The plugin allows the caller to specify the new account's role, enabling attackers to create administrator accounts.
An unauthenticated attacker over the network can create administrator accounts and gain complete control of the WordPress site.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update the Security For WooCommerce plugin to a version beyond 1.0.16. Alternatively, disable the plugin until an update is available. Monitor user accounts for unauthorized administrator-level accounts that may have been created.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-100109 . See article
NVD published the first details for CVE-2026-100109
A CVSS base score of 9.8 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-vh3v-vj4j-59pc] The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not per
CVE-2026-100109 - Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user CVE ID : CVE-2026-100109 Published : 5 listopada 2026 08:17 | 51 minut ago Description : The Security For WooCommerce WordPress plugin from 1....
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
[GHSA-vh3v-vj4j-59pc] The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not per
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
