CVE-2026-100109

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

November 5, 2026

Last Seen

November 5, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Vulnerability in Security For WooCommerce Plugin Allows Unauthenticated Admin Account Creation72.0

The Security For WooCommerce WordPress plugin, versions 1.0.10 to 1.0.16, has a critical vulnerability (CVE-2026-100109) that allows unauthenticated users to create new user accounts with administrative privileges. This flaw arises from the plugin's failure to perform capability checks when creating...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Vulnerability in Security For WooCommerce Plugin Allows Unauthenticated Admin Account Creation

13h ago·1 sources

Related Articles (2)

Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user High & Critical Vulnerabilities / 6h WordPress - Security For WooCommerce - CRITICAL - CVE-2026-100109. The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administr

securityvulnerability.io·13h ago

CVE-2026-100109 - Exploits & Severity

Feedly·21h ago

Related Entities

Data Breach Zero-day Exploit CWE-269 - Improper Privilege Management CWE-287 - Improper Authentication CWE-200 - Exposure of Sensitive Information T1068 - Exploitation for Privilege Escalation WordPress