Security For WooCommerce Admin Account Creation Flaw (CVE-2026-100109)

CVE-2026-100109 affects the Security For WooCommerce plugin, versions 1.0.10 to 1.0.16. The CVE record says the plugin does not check capabilities when it creates users through an action available to unauthenticated visitors. It also lets the caller choose the new account's role. An attacker can therefore ask for an administrator account and take over the site.

The record files the weakness under CWE-862, Missing Authorization. WPScan's own entry classifies it as privilege escalation under CWE-269. The record title names usfw_create_temporary_user as the affected function. The record does not describe how that action is reached or which request triggers it.

In WordPress, an administrator can install plugins and edit theme files, which usually means code execution on the server. That is why a flaw that hands out administrator accounts is rated as a full site takeover. This reading is ours; the record states only that attackers can create administrator accounts and take over the site.

What WPScan and the Plugin Directory Say

WPScan, the CNA, lists the finder as Afan and shows the entry as publicly published on 3 November 2026. Its page says the proof of concept will be displayed on 1 February 2027 to give users time to update. It also states that there is no known fix.

The WordPress.org plugin page says the plugin was closed on 13 October 2026 and is not available for download. It calls the closure temporary, pending a full review. Sites that installed the plugin earlier keep running it, and we recommend treating them as exposed.

What the Scores and CISA KEV Say

The record carries a CVSS 3.0 score of 9.8 Critical from WPScan, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD lists that score as secondary and received the entry on 5 November 2026 without its own analysis yet. There is no CVSS 3.1 or 4.0 score in the record or NVD.

As of CISA catalog version 2026.11.04, the CVE is not in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains what the catalog covers and how to read it.

The CVE record lists the Security For WooCommerce plugin from 1.0.10 through 1.0.16, as a single semver range. The record gives the vendor as Unknown and the default status as unknown. WPScan lists the WordPress.org plugin slug as ultimate-security-for-woocommerce, which is the name to search for on your sites.

The record names no versions before 1.0.10, and we do not read that as proof that earlier releases are safe. We recommend removing the plugin on any version until the author publishes a fixed release. Our vulnerability management guide covers how to track a plugin with no patch.

The WordPress exposure check can help you review what a public WordPress site reveals about its plugins and versions. Run it alongside an internal inventory, because the plugin may be inactive but still installed.