Security For WooCommerce plugin lets anyone create administrator accounts
Anyone can gain admin rights through a WordPress shop plugin and take over the site!
Summary
The Security For WooCommerce WordPress plugin does not check permissions when creating users, so unauthenticated visitors can create administrator accounts and take over the site. Versions 1.0.10 to 1.0.16 are affected.
What to do
No fixed version is known yet. Check that the plugin you run is newer than 1.0.16, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen