CVE-2026-100109: WordPress Takeover via Security For WooCommerce Plugin

CVE-2026-100109 identifies a critical vulnerability in the WordPress plugin 'Security For WooCommerce', versions 1.0.10 through 1.0.16. The flaw lies in missing capability checks in user account creation code. A vulnerable action is accessible to completely unauthenticated visitors, allowing them to create a new account and select administrator role. The impact is catastrophic: anyone on the Internet can create an administrator account and take complete control of the WordPress site.

Although a CVSS score is not yet reported, the vulnerability is intrinsically critical by nature of the access it grants: unauthenticated administrator account creation. The vulnerability was disclosed on NVD November 5, 2026, and working proof-of-concept exploits have been published on GitHub repositories as of November 6. The fact that a security-focused plugin is itself vulnerable at this level compounds risk for sites relying on it for protection.

The most urgent action is to immediately disable the plugin on all affected sites. Administrators must audit the user list, looking for suspicious administrator accounts created recently. Review access logs for anomalous activity occurring after November 5, 2026. If available, implement WAF rules to block the vulnerable request until a patch is released.