Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-123702 EUVD-2026-123206GHSA-fw3h-f59m-m57g

Security For WooCommerce <= 1.0.16 - Unauthenticated wp-config Keys and Salts Reset and Denial of Service

Published Nov 11, 2026 · Updated Nov 11, 2026 · Assigned by WPScan

Description

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.

Affected products

VendorProductAffectedFixed
— Security For WooCommerce ≤ 1.0.16 —

References