CVE-2026-100109

{
  "etk_id": "ETK-2026-3600",
  "cve_id": "CVE-2026-100109",
  "display_id": "CVE-2026-100109",
  "ghsa_id": "GHSA-vh3v-vj4j-59pc",
  "euvd_id": "EUVD-2026-117402",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated administrator account creation in Security For WooCommerce",
  "summary": "Security For WooCommerce versions 1.0.10 through 1.0.16 allow unauthenticated requests to create user accounts without required capability checks. An attacker can assign an administrative role to a new account and take over the affected WordPress site; exploitation requires access to the exposed unauthenticated action.",
  "mitigation": "Remove or disable the affected plugin until an updated release is available. Restrict public access to the WordPress site or the affected action where operationally feasible, and review user accounts for unexpected administrators.",
  "vendor": null,
  "product": "Security For WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.10, <= 1.0.16"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Security For WooCommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 65.10268643333333,
  "t0_at": "2026-11-05T07:35:20.438000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T07:35:20.438000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T07:35:20.438000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100109"
    }
  }
}