CVE-2026-123697 Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure
Unauthenticated users can obtain two-factor codes and secrets for any account, bypassing 2FA on sites using the Security For WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-123697?
CVE-2026-123697 is a high-severity missing authorization vulnerability in Unknown Security For WooCommerce, published on 11 Nov 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.
Weakness: CWE-862
Which versions are affected by CVE-2026-123697?
Only installations with a non-default setting turned on are exposed.
How do I fix CVE-2026-123697?
No fix has been published for CVE-2026-123697 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-123697 being exploited?
There is no known exploitation of CVE-2026-123697 in the wild and no public exploit code.
Sources
Also known as GHSA-cg7c-763h-xv22.