What is GHSA-fw3h-f59m-m57g?

GHSA-fw3h-f59m-m57g is a security advisory published by GitHub Security Advisories with Medium severity. The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is...

Which CVE IDs does GHSA-fw3h-f59m-m57g cover?

GHSA-fw3h-f59m-m57g covers the following CVE IDs: CVE-2026-123702. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fw3h-f59m-m57g?

GHSA-fw3h-f59m-m57g has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-fw3h-f59m-m57gMediumCVSS 6.5

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-123702 →

📋 Description

The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-123702
https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5
https://github.com/advisories/GHSA-fw3h-f59m-m57g