CVE-2026-100109

Summary

The Security For WooCommerce WordPress plugin (versions 1.0.10–1.0.16) exposes an unauthenticated endpoint that allows anyone to create new users without capability checks and with arbitrary role selection, enabling attackers to register as administrators.

Exploitability

Trivial to exploit; requires only sending a single HTTP request to the vulnerable action endpoint without authentication or authorization.

Blast radius

Successful exploitation grants full administrative control of the WordPress site, enabling complete data exfiltration, malware deployment, or site defacement.

Detection

Look for POST requests to the plugin's user creation endpoint (e.g., /wp-admin/admin-ajax.php?action=wc_security_create_user) from unauthenticated IP addresses with a 'role' parameter set to 'administrator' in the request body; such requests should not succeed without proper authentication and permissions.

Prioritized remediation

Upgrade to Security For WooCommerce plugin version 1.0.17 or later, which patches the missing capability checks and role restriction.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.