VulnSocial

CVE-2026-100109

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-11-05: 211-05
Referenced assets2 URLs
Full discourse2 posts
  • cve.now@cvedotnow

    🆕 New CVE Security For WooCommerce: privilege escalation in temporary user creation (CVE-2026-100109) Unauthenticated visitors can create administrator accounts and take over the site. No patch listed yet https://cve.now/CVE-2026-100109?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical

    00022656
    21.7K followersView on X
  • Enclave Radar@EnclaveRadar

    🆕 New CVE: CVE-2026-100109 (CVSS 9.8, Enclave score 8/10) Unknown Security For WooCommerce · Privilege escalation Remote, no login needed. The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when… https://app.enclave.ai/threat-feed/CVE-2026-100109

    0001096
    184 followersView on X

Explore more

Back to dashboard