The Security For WooCommerce WordPress plugin from version 1.0.10 to 1.0.16 contains a flaw that skips capability checks when creating users via the usfw_create_temporary_user action, which is exposed to unauthenticated visitors. This allows an attacker to specify the role of the newly created account, creating administrator accounts that grant full site control. The vulnerability directly leads to a compromise of confidentiality, integrity, and availability by giving attackers unrestricted administrative access to the WordPress installation.

Any WordPress site that has the Security For WooCommerce plugin installed in a version from 1.0.10 through 1.0.16 is affected. No other vendors or products are mentioned in the current data.

The CVSS score of 9.8 indicates a critical severity. No EPSS score is available, and the vulnerability is not currently listed in CISA KEV. The attack vector is an unauthenticated web request to the plugin’s action endpoint, requiring no credentials or prior access. If exploited, an attacker can create a privileged account and take over the entire site.