WordPress Security For WooCommerce Plugin Account Takeover Flaw

The Security For WooCommerce WordPress plugin contains a missing capability check vulnerability that allows unauthenticated attackers to create new user accounts.

Affected versions are 1.0.10 through 1.0.16. The vulnerable action is available to unauthenticated visitors and does not verify permissions before creating a user.

• Affected versions: 1.0.10 to 1.0.16
• Attackers can choose the new account's role
• Impact: unauthenticated attackers can create administrator accounts and take over the site