Skip to content
Critical Vulnerability in Security For WooCommerce Plugin Allows Unauthenticated Admin Account Creation

Critical Vulnerability in Security For WooCommerce Plugin Allows Unauthenticated Admin Account Creation

First seen 5 Nov 2026, 17:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 17:48 UTC
  • •CVE-2026-100109 allows unauthenticated user account creation with admin privileges.
  • •Affected versions of the plugin range from 1.0.10 to 1.0.16.
  • •Immediate action is required: update the plugin or disable it to prevent exploitation.

The Security For WooCommerce WordPress plugin, versions 1.0.10 to 1.0.16, has a critical vulnerability (CVE-2026-100109) that allows unauthenticated users to create new user accounts with administrative privileges. This flaw arises from the plugin's failure to perform capability checks when creating users through an action accessible to unauthenticated visitors. Attackers can exploit this vulnerability to gain full control of affected WordPress sites, potentially leading to data breaches and site defacement. As of today, there is no public proof-of-concept or confirmed exploitation reported. Users are advised to update the plugin to a version beyond 1.0.16 or disable it until a patch is available. The CVSS score assigned to this vulnerability is 9.8, indicating its critical nature.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 12h ago How this analysis works

Timeline

2026-11-05
CVE-2026-100109 published
The vulnerability in the Security For WooCommerce plugin was disclosed, allowing unauthenticated users to create admin accounts.
Feedly
2026-11-05
Public PoC available
Proof-of-concept code for the vulnerability was made publicly available, increasing the risk of exploitation.
securityvulnerability.io

More articles in this cluster (4)

Following this threat?

Track CVE-2026-100109 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

Which versions of the plugin are affected?
The vulnerability affects Security For WooCommerce plugin versions 1.0.10 to 1.0.16.
Is there a patch available?
No, users are advised to update to a version beyond 1.0.16 or disable the plugin until a patch is released.
What actions should I take immediately?
Update the plugin or disable it to prevent unauthorized access until a fix is available.