{
  "id": "CVE-2026-100109",
  "url": "https://spydr.io/cve/CVE-2026-100109",
  "published": "2026-11-05T08:17:01.870Z",
  "modified": "2026-11-05T08:17:01.870Z",
  "score": 9.8,
  "severity": "critical",
  "cvss_version": "3.0",
  "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "score_source": "wpscan.com",
  "epss": 0.00369,
  "epss_percentile": 0.30959,
  "exploited": false,
  "kev": null,
  "ssvc_exploitation": null,
  "vendors": [],
  "products": [
    "Security For WooCommerce"
  ],
  "cwes": [],
  "description": "The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.",
  "status": "Received",
  "score_type": "Secondary",
  "scores": {
    "cvss_v40": null,
    "cvss_v31": null,
    "cvss_v30": 9.8
  },
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/",
      "tags": []
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100109",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}