Access Control Flaw in Security For WooCommerce Plugin Exposes Admin Emails
CVE-2026-123704
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123704?
The Security For WooCommerce plugin for WordPress, specifically versions up to 1.0.16, contains a significant access control vulnerability. This weakness allows unauthenticated users to leverage one of its REST API routes, enabling them to retrieve the email addresses of all site administrators. This poses a serious privacy risk and may facilitate targeted attacks against the site's administrators.
Affected Version(s)
Security For WooCommerce 0 <= 1.0.16
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.