CVE-2026-123700 in Security for WooCommerce Plugin
Summary
by MITRE • 11/11/2026
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/11/2026
The vulnerability identified in the Security For WooCommerce WordPress plugin versions up through 1.0.16 represents a critical failure in access control mechanisms, specifically manifesting as an Unrestricted Function Access flaw. This security defect allows unauthenticated users to execute administrative-level actions without providing valid credentials or possessing the necessary permissions. The core technical issue lies within several comment cleanup functions that are registered with WordPress action hooks but lack sufficient verification of the requester's authorization status before execution. In a typical secure implementation, any function capable of modifying critical site data such as comments must first verify that the current user has the appropriate capabilities defined by the Content Management System’s role and capability architecture. The absence of this check creates an open door for malicious actors to interact directly with these endpoints via HTTP requests, bypassing standard authentication gateways entirely.
From a technical perspective, the flaw enables remote attackers to trigger cleanup routines that are intended only for site administrators or moderators who manage content moderation workflows. By exploiting this lack of authorization checks, an attacker can send crafted requests to specific plugin endpoints associated with comment deletion. Because these functions do not validate whether the incoming request originates from a logged-in user with elevated privileges, they proceed to execute their destructive logic immediately upon receipt. This behavior effectively treats any external input as if it came from a trusted administrator, which is a fundamental violation of the principle of least privilege and secure by design standards. The vulnerability falls under CWE-862 Missing Authorization in the Common Weakness Enumeration taxonomy, highlighting that the software fails to enforce proper access controls on resources protected by an authorization mechanism.
The operational impact of this vulnerability is severe due to its potential for complete data loss regarding user engagement and transactional records. An unauthenticated attacker can permanently delete all comments hosted on the WordPress site, including those marked as approved or pending review. More critically, because the plugin integrates with WooCommerce, these cleanup actions also affect order notes attached to customer purchases. Order notes often contain sensitive information such as shipping instructions, payment details, internal communication between support staff and customers, and troubleshooting logs for technical issues. The permanent deletion of this data not only disrupts business operations but can lead to significant financial loss, legal compliance issues regarding record retention, and a breakdown in trust with the customer base. This scenario aligns with ATT&CK technique T1485 Data Destruction, where an adversary aims to destroy or manipulate data to hinder recovery efforts or cause operational disruption.
Mitigation strategies for this vulnerability require immediate action by site administrators who are running affected versions of the plugin. The primary and most effective remediation is to upgrade the Security For WooCommerce WordPress plugin to version 1.0.17 or later, where the developers have implemented proper authorization checks within the comment cleanup functions. Until an update can be applied, temporary mitigations may include restricting access to the WordPress installation via IP whitelisting if feasible, although this does not fully address the root cause since authenticated administrators could still inadvertently trigger these actions if their credentials are compromised. Additionally, implementing a Web Application Firewall with rules specifically targeting known exploitation patterns for this plugin can provide an additional layer of defense by blocking malicious requests before they reach the application logic. Regular security audits and adherence to secure coding practices that mandate explicit authorization verification for all state-changing operations are essential to prevent similar vulnerabilities in future development cycles.