CVE-2026-123705

{
  "etk_id": "ETK-2026-4147",
  "cve_id": "CVE-2026-123705",
  "display_id": "CVE-2026-123705",
  "ghsa_id": "GHSA-hh2g-xmp5-mcp2",
  "euvd_id": "EUVD-2026-123209",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated REST API information disclosure in Security For WooCommerce",
  "summary": "Security For WooCommerce 1.0.16 and earlier exposes a REST API endpoint without required access controls. An unauthenticated remote user can obtain server, PHP, WordPress, and plugin configuration information, including the site administrator's email address, when the affected plugin is installed on a reachable WordPress site.",
  "mitigation": "Disable or remove affected plugin versions, or restrict unauthenticated access to its REST API endpoints at the web server, reverse proxy, or WAF. Upgrade only after confirming a vendor release that addresses this issue, as the evidence does not name a fixed version.",
  "vendor": null,
  "product": "Security For WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.0.16"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Security For WooCommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 33.652908233333335,
  "t0_at": "2026-11-11T06:00:15.801000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T06:00:15.801000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T06:00:15.801000+00:00",
      "url": "https://github.com/advisories/GHSA-hh2g-xmp5-mcp2"
    }
  }
}