Unauthenticated Admin Account Creation in Security for WooCommerce

Executive Summary

This vulnerability is in the Security For WooCommerce WordPress plugin versions 1.0.10 to 1.0.16. It allows unauthenticated attackers to create new user accounts with any role, including administrator, due to missing capability checks during user creation. This lets attackers gain full control of the WordPress site.

Useful 0 Not Useful 0

Detection Guidance

Check if the Security For WooCommerce plugin version is between 1.0.10 and 1.0.16. Look for unauthorized user creation, especially administrator accounts, in WordPress logs or database.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to create an admin account, take over your WordPress site, steal data, install malware, or deface the site. Since no authentication is required, any visitor could potentially exploit this if the plugin is installed and outdated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Security For WooCommerce plugin to the latest version immediately. Remove any unauthorized administrator accounts created. Review user roles and permissions for suspicious changes.

Useful 0 Not Useful 0