MinorCritical vulnerability
CVE-2026-123697 (CVSS 7.5)
NVD · officialPublished Nov 11, 2026Risk 23/100
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.
Technical details
CVSS
7.5
AV:NetworkAC:HighPR:LowUI:NoneC:HighI:HighA:High
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source