{"api_version":"1","generated_at":"2026-11-11T07:11:32+00:00","cve":"CVE-2026-123701","urls":{"html":"https://cve.report/CVE-2026-123701","api":"https://cve.report/api/cve/CVE-2026-123701.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-123701","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-123701"},"summary":{"title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Reset","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-11 06:17:19","updated_at":"2026-11-11 06:17:19"},"problem_types":["CWE-862 Missing Authorization"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e/","name":"https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123701","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123701","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Security For WooCommerce","version":"affected 1.0.16 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Benjamin Kincses (Dextheking1)","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Benjamin Kincses (Dextheking1)"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall."}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T06:00:15.102Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e/"}],"source":{"discovery":"EXTERNAL"},"title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Reset","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-123701","datePublished":"2026-11-11T06:00:15.102Z","dateReserved":"2026-11-06T09:50:06.653Z","dateUpdated":"2026-11-11T06:00:15.102Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-11 06:17:19","lastModifiedDate":"2026-11-11 06:17:19","problem_types":["CWE-862 Missing Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"123701","Ordinal":"1","Title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Sett","CVE":"CVE-2026-123701","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"123701","Ordinal":"1","NoteData":"The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall.","Type":"Description","Title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Sett"}]}}}