The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site. | |
| Title | Security For WooCommerce <= 1.0.16 - Unauthenticated Administrator Email Address Disclosure | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-11T06:00:15.626Z
Reserved: 2026-11-06T09:50:11.720Z
Link: CVE-2026-123704
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-11T06:17:19.703
Modified: 2026-11-11T06:17:19.703
Link: CVE-2026-123704
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.