{"api_version":"1","generated_at":"2026-11-11T06:41:13+00:00","cve":"CVE-2026-123704","urls":{"html":"https://cve.report/CVE-2026-123704","api":"https://cve.report/api/cve/CVE-2026-123704.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-123704","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-123704"},"summary":{"title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Administrator Email Address Disclosure","description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-11 06:17:19","updated_at":"2026-11-11 06:17:19"},"problem_types":["CWE-200 Information Exposure"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1/","name":"https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123704","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123704","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Security For WooCommerce","version":"affected 1.0.16 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Benjamin Kincses (Dextheking1)","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Benjamin Kincses (Dextheking1)"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site."}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T06:00:15.626Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1/"}],"source":{"discovery":"EXTERNAL"},"title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Administrator Email Address Disclosure","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-123704","datePublished":"2026-11-11T06:00:15.626Z","dateReserved":"2026-11-06T09:50:11.720Z","dateUpdated":"2026-11-11T06:00:15.626Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-11 06:17:19","lastModifiedDate":"2026-11-11 06:17:19","problem_types":["CWE-200 Information Exposure"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"123704","Ordinal":"1","Title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Administrat","CVE":"CVE-2026-123704","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"123704","Ordinal":"1","NoteData":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.","Type":"Description","Title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Administrat"}]}}}