critical
CVE-2026-100109
Security For WooCommerce 1.0.10-1.0.16 lets an unauthenticated visitor create a user of a chosen role (usfw_create_temporary_user has no capability check) - site takeover, and NO fixed release exists (CVSS 9.8)
- Severity
- critical
- Affected product
- ultimate-security-for-woocommerce
- Affected versions
- ultimate-security-for-woocommerce ≥ 1.0.10, ≤ 1.0.16
- Detection basis
- Component version range
- Shipped rule
- ultimate-security-for-woocommerce: Security For WooCommerce 1.0.10-1.0.16 lets an unauthenticated visitor create a user of a chosen role (usfw_create_temporary_user has no capability check) - site takeover, and NO fixed release exists (CVSS 9.8)
- Added to NewScan
- 2026-11-05
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints ultimate-security-for-woocommerce from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.