{"affected":[{"defaultStatus":"unknown","product":"Security For WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123697","cwes":["CWE-862"],"description":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/"}],"kev":null,"metrics":[],"modifiedAt":1794376814396,"publishedAt":1794376814396,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/"}],"remediation":[],"revision":"607d484bc1cce28a5300836b9cd8ae4aeefa3c7bad7f096ed7c0e628411b8aa7","sources":[{"modifiedAt":1794376814396,"name":"CNA: WPScan","retrievedAt":1794377429672,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123697"}],"ssvc":null,"status":"published","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure","updatedAt":1794377429672}