Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user High & Critical Vulnerabilities / 6h WordPress - Security For WooCommerce - CRITICAL - CVE-2026-100109. The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administr

The Security For WooCommerce plugin for WordPress, versions from 1.0.10 to 1.0.16, is susceptible to a serious vulnerability that allows unauthenticated users to bypass capability checks when creating new user accounts. This flaw permits attackers to designate roles for the newly created accounts, potentially granting them administrator privileges. As a result, an unauthorized individual could gain administrative control over the site, leading to possible data breaches, site defacement, and further exploitation.

Security For WooCommerce 1.0.10 <= 1.0.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-100109 - Proof of Concept

Download the Critical Vulnerability Management Cheat Sheet

🟡 Public PoC available Nov 5, 2026

👾 Exploit known to exist Nov 5, 2026

Exploit known to exist

Vulnerability published Nov 5, 2026

Vulnerability published

Vulnerability Reserved Sep 25, 2026

Vulnerability Reserved