---
id: CVE-2026-100109
title: >-
  Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege
  Escalation via usfw_create_temporary_user
summary: >-
  The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not
  perform capability checks when creating users through an action available to
  unauthenticated visitors, and lets the caller choose the new account's role,
  allowi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-862
product: Security For WooCommerce
affected:
  - security_for_woocommerce >= 1.0.10 <= 1.0.16
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T19:20:50.546639Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:21:04.971Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-100109'
references:
  - url: 'https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/'
tags:
  - cve.org
epss: 0.00369
epssPercentile: 0.30959
ingestedAt: '2026-11-05T22:38:31.528Z'
---

## Overview

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

## Affected

- `security_for_woocommerce >= 1.0.10 <= 1.0.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.