{"affected":[{"defaultStatus":"unknown","product":"Security For WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123696","cwes":["CWE-862"],"description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d/"}],"kev":null,"metrics":[],"modifiedAt":1794376814221,"publishedAt":1794376814221,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d/"}],"remediation":[],"revision":"7a133ae0211e5e5204b111f46b90c453e9da16c4b5f6f46a0175477f18c95962","sources":[{"modifiedAt":1794376814221,"name":"CNA: WPScan","retrievedAt":1794377428534,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123696"}],"ssvc":null,"status":"published","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset","updatedAt":1794377428534}