PULSE
EN
FEED
ransomaoqin reclama a Sistel · BR · Technologyransombyod reclama a First and Final Warning - IHG Hotels & Resorts (Estate) · Hospitalityransomqilin reclama a Calvary Christian College · AU · Educationransomeverstake reclama a ne*****h.comransomauditteam reclama a kx***om · CN · Technologyransompixelleaks reclama a Disclosed · Otherransomdark project reclama a Custom Bakehouse · US · Retail & E-Commerceransomdestello reclama a MAPFRE Brasil 2026 · BR · Financial Servicesransomthegentlemen reclama a MKG Kirchrode · DE · Manufacturingransomn0n reclama a Delta Dental of Missouri · US · Healthcareransomn0n reclama a The Container Store · US · Retail & E-Commerceransomlockbit5 reclama a centratamagroup.com · BR · Otherransommedusalocker reclama a Msn · US · Technologyransommedusalocker reclama a baiapai · Technologyransomaoqin reclama a Sistel · BR · Technologyransombyod reclama a First and Final Warning - IHG Hotels & Resorts (Estate) · Hospitalityransomqilin reclama a Calvary Christian College · AU · Educationransomeverstake reclama a ne*****h.comransomauditteam reclama a kx***om · CN · Technologyransompixelleaks reclama a Disclosed · Otherransomdark project reclama a Custom Bakehouse · US · Retail & E-Commerceransomdestello reclama a MAPFRE Brasil 2026 · BR · Financial Servicesransomthegentlemen reclama a MKG Kirchrode · DE · Manufacturingransomn0n reclama a Delta Dental of Missouri · US · Healthcareransomn0n reclama a The Container Store · US · Retail & E-Commerceransomlockbit5 reclama a centratamagroup.com · BR · Otherransommedusalocker reclama a Msn · US · Technologyransommedusalocker reclama a baiapai · Technology
← Todos los CVEs
CVE Watch5 nov 2026

CVE-2026-100109

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action

CVSS

9.8

Crítico

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 5 nov 2026 · Última mod.: 5 nov 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.

Referencias oficiales
CVEs relacionados

Sin CVEs relacionados por CWE o producto.