Security For WooCommerce vulnerabilities
We track 5 vulnerabilities in Security For WooCommerce products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Security For WooCommerce vulnerabilities
- 7.5 High severity
Security For WooCommerce: Missing Authorization
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approve
- 7.5 High severity
Security For WooCommerce: Missing Authorization
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its
- 7.5 High severity
Security For WooCommerce: Missing Authorization
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every accoun
- 9.8 Critical severity
Security For WooCommerce: Improper Privilege Management
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including adminis
- 9.8 Critical severity
Security For WooCommerce: Missing Authorization
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated atta