CVE-2026-100109 critical vulnerability summary
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new accou...
CVE-2026-100109 is a Critical severity vulnerability notice that security teams should triage for exposure in their own environments.
What to review
The affected area appears to involve The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users. Administrators should compare this notice against their asset inventory, dependency list, and externally exposed services.
Recommended action
Confirm whether the affected product or library is present, review vendor guidance, prioritize patching based on internet exposure and severity, and monitor logs for suspicious behavior tied to the affected component.
This brief is based on information from Tenable Newest CVEs . Please refer to the original source for the complete advisory and vendor-specific guidance.
Related Posts
CVE-2026-123025 critical vulnerability summary
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field an...
CVE-2026-123029 high vulnerability summary
Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.
CVE-2026-123033 high vulnerability summary
Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauth...