{"metadata": {"vulnerability": "CVE-2026-100109", "count": 28, "kinds": {"milestone": 4, "sighting": 16, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T11:16:45.144Z", "date_only": false, "value": "2026-09-25T11:16:45.144Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-100109", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T07:35:20.438Z", "date_only": false, "value": "2026-11-05T07:35:20.438Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T07:35:20.438Z", "date_only": false, "value": "2026-11-05T07:35:20.438Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-100109", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T07:44:42.306Z", "date_only": false, "value": "2026-11-05T07:44:42.306359Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117562715784418428", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "8e07993a-e631-4983-8ca0-ab9d1b4ce776", "content": "CVE-2026-100109 Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.\nhttps://www.cve.org/CVERecord?id=CVE-2026-100109https://wpscan.com/vulnerability/b4d26eb3-ab32-456e-9f69-9ab300fdf44c/#CVE_2026_100109#bot", "url": "https://infosec.exchange/users/cve/statuses/117562715784418428"}, {"timestamp": "2026-11-05T08:00:34.281Z", "date_only": false, "value": "2026-11-05T08:00:34.281941Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117562778162930256", "record": "cve-2026-100109", "field": "creation_timestamp", "uuid": "3fd8ea66-7f85-4b7d-a390-94a7cdb46dc8", "content": "CVE-2026-100109: Security For WooCommerce v1.0.10 \u2013 1.0.16 suffers a CRITICAL auth bypass. Attackers can create admin accounts without logging in \u2014 site takeover possible. Disable or upgrade plugin ASAP. https://radar.offseq.com/threat/cve-2026-100109-cwe-862-missing-authorization-in-security-for-woocommerce-17a9f2ddd03e44c0 #OffSeq #WordPress #CVE2026100109 #Infosec", "url": "https://infosec.exchange/users/offseq/statuses/117562778162930256"}, {"timestamp": "2026-11-05T08:00:36.472Z", "date_only": false, "value": "2026-11-05T08:00:36.472761Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mzkflz4y3s25", "record": "cve-2026-100109", "field": "creation_timestamp", "uuid": "d39c0c70-879b-44e9-86fd-575d9792220e", "content": "Security For WooCommerce v1.0.10 \u2013 1.0.16: CRITICAL flaw lets unauthenticated attackers create admin users \u2014 site takeover possible. Upgrade or disable plugin immediately. https://radar.offseq.com/threat/cve-2026-100109-cwe-862-missing-authorization-in-security-for-woocommerce-17a9f2ddd03e44c0 #O...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mzkflz4y3s25"}, {"timestamp": "2026-11-05T08:15:05.520Z", "date_only": false, "value": "2026-11-05T08:15:05.520049Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mzkgfwp4gx2m", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "d868ad89-fb36-438c-a6b8-0eac59e349e8", "content": "The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role.\n\nhttps://www.fc-vulns.com/cve/CVE-2026-100109/\n\n#fcvulns #Wordpress", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3mzkgfwp4gx2m"}, {"timestamp": "2026-11-05T08:17:01Z", "date_only": false, "value": "2026-11-05T08:17:01Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VH3V-VJ4J-59PC", "record": "GHSA-VH3V-VJ4J-59PC", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-05T08:17:01.870Z", "date_only": false, "value": "2026-11-05T08:17:01.870", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100109", "record": "FKIE_CVE-2026-100109", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T08:20:03.147Z", "date_only": false, "value": "2026-11-05T08:20:03.147430Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkgosd3kw25", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "4b93ce44-f7c9-47c6-b124-7d69d5175c58", "content": "CVE-2026-100109 - security for woocommerce\nThe Security For WooCommerce plugin versions 1.0.10 through 1.0.16 allow anyone on the internet to create new user accounts and choose the role, including administrator.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkgosd3kw25"}, {"timestamp": "2026-11-05T08:31:07.647Z", "date_only": false, "value": "2026-11-05T08:31:07.647243Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzkhckyati2q", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "848d26c5-4f82-4b10-b573-3cc8c0fbd3ab", "content": "\ud83d\udd34 CVE-2026-100109 - Critical (9.8)\n\nThe Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability c...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100109/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzkhckyati2q"}, {"timestamp": "2026-11-05T09:30:22Z", "date_only": false, "value": "2026-11-05T09:30:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VH3V-VJ4J-59PC", "record": "GHSA-VH3V-VJ4J-59PC", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T09:30:22Z", "date_only": false, "value": "2026-11-05T09:30:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VH3V-VJ4J-59PC", "record": "GHSA-VH3V-VJ4J-59PC", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T09:30:27.307Z", "date_only": false, "value": "2026-11-05T09:30:27.307688Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/c44ohqj7vv5fy", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "518656d0-e781-40c0-8e0f-ac419374a12e", "content": "CVE-2026-100109 - Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user\nCVE ID : CVE-2026-100109\n \n Published : 5 listopada 2026 08:17 | 51\u00a0minut ago\n \n Description : The Security For WooCommerce WordPress plugin from 1....", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/c44ohqj7vv5fy"}, {"timestamp": "2026-11-05T10:07:15.807Z", "date_only": false, "value": "2026-11-05T10:07:15.807573Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzkmoj33em2b", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "7202950d-e106-4907-8722-96901e6d3dcb", "content": "\ud83d\udea8 CVE-2026-100109 \u2014 CVSS 9.8 CRITICAL\n\nThe Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-100109\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzkmoj33em2b"}, {"timestamp": "2026-11-05T11:00:36.606Z", "date_only": false, "value": "2026-11-05T11:00:36.606928Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117563486081196590", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "8b040313-d0b7-431b-9af3-413f83eb81b0", "content": "CVE-2026-100109: Security For WooCommerce WordPress plugin v1.0.10 \u2013 1.0.16 has a CRITICAL flaw (CVSS 9.8) allowing unauthenticated admin account creation \u2014 full site compromise possible. Disable or restrict now. https://radar.offseq.com/threat/the-security-for-woocommerce-wordpress-plugin-from-1010-to-1016-does-not-perform-capability-checks-c68d3315e500ee5d #OffSeq #WordPress #Security", "url": "https://infosec.exchange/users/offseq/statuses/117563486081196590"}, {"timestamp": "2026-11-05T19:20:50.546Z", "date_only": false, "value": "2026-11-05T19:20:50.546639Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100109", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-05T19:20:50.546Z", "date_only": false, "value": "2026-11-05T19:20:50.546639Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100109", "record": "FKIE_CVE-2026-100109", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-05T19:21:04.971Z", "date_only": false, "value": "2026-11-05T19:21:04.971Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-100109", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T19:21:04.971Z", "date_only": false, "value": "2026-11-05T19:21:04.971Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100109", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T20:17:36.783Z", "date_only": false, "value": "2026-11-05T20:17:36.783", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100109", "record": "FKIE_CVE-2026-100109", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T00:00:15.268Z", "date_only": false, "value": "2026-11-06T00:00:15.268867Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mzm37yudm72h", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "86e9992f-9d05-47f8-a13b-ec0abefc6c8a", "content": "CVE-2026-100109 (CVSS 9.8). Security For WooCommerce 1.0.10\u20131.0.16. Any visitor creates admin accounts. Your site is gone.\n\nNo patch. Disable it now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #CVE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mzm37yudm72h"}, {"timestamp": "2026-11-06T08:09:25.913Z", "date_only": false, "value": "2026-11-06T08:09:25.913067Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/windowsfaq.bsky.social/post/3mzmwkmf3w22j", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "c9a4b028-d428-47cf-a770-b7d895d035d9", "content": "Kritische WordPress-Sicherheitsl\u00fccke: CVE-2026-100109 erreicht CVSS 9,8.\n\nIm Plugin Security For WooCommerce k\u00f6nnen Angreifer ohne Anmeldung Administratoren anlegen. Ein Patch fehlt bisher.\n\nBetroffene Shops sollten handeln.\n\n#WordPress #Security #WooCommerce\n\nwww.windows-faq.de/2026/11/06/w...", "url": "https://bsky.app/profile/windowsfaq.bsky.social/post/3mzmwkmf3w22j"}, {"timestamp": "2026-11-06T15:00:09Z", "date_only": false, "value": "2026-11-06T15:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109349", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "edc07741-222f-44e0-a3b2-da04970da350", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-100109-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a thiscitze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-06 13:31:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109349", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-06T15:00:09Z", "date_only": false, "value": "2026-11-06T15:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/109349", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "ab34fd7f-8195-404e-8509-66813086b1ed", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-100109-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a thiscitze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-06 13:31:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109349"}, {"timestamp": "2026-11-06T15:00:21Z", "date_only": false, "value": "2026-11-06T15:00:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/PhzPNiZ12WGrXHtbF1XNLZh4Mp1egygz7RueMny8_isF_XQ", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "c59df19b-aff2-4ad1-8e3e-8b52d71445ec", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-06T15:00:21Z", "date_only": false, "value": "2026-11-06T15:00:21.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/PhzPNiZ12WGrXHtbF1XNLZh4Mp1egygz7RueMny8_isF_XQ", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "51948452-d374-483f-9fec-65d90655ebfa"}, {"timestamp": "2026-11-10T21:45:50.065Z", "date_only": false, "value": "2026-11-10T21:45:50.065161Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/4jtbcn25nnqkn", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "9b19dde0-4929-4db9-9413-223d831ec1c7", "content": "\ud83d\udea8 CVE-2026-100109\nCVSS 9.8 / EPSS 0.37% / KEV: No\nTL;DR: The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to\u2026\nhttps://cvesentinel.com/report/CVE-2026-100109\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/4jtbcn25nnqkn"}], "metrics": {"as_of": "2026-11-13T14:22:00.662Z", "anchors": {"origin": {"timestamp": "2026-11-05T07:35:20.438Z", "date_only": false, "value": "2026-11-05T07:35:20.438Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-05T07:35:20.438Z", "date_only": false, "value": "2026-11-05T07:35:20.438Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-06T15:00:09Z", "date_only": false, "value": "2026-11-06T15:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109349", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "edc07741-222f-44e0-a3b2-da04970da350", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-100109-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a thiscitze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-06 13:31:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109349", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 113088.562, "hours": 31.413489444444448, "days": 1.3088953935185186, "min_seconds": 113088.562, "max_seconds": 113088.562, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T07:35:20.438Z", "date_only": false, "value": "2026-11-05T07:35:20.438Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T15:00:09Z", "date_only": false, "value": "2026-11-06T15:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109349", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "edc07741-222f-44e0-a3b2-da04970da350", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-100109-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a thiscitze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-06 13:31:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109349", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 715600.224893, "hours": 198.77784024805555, "days": 8.282410010335647, "min_seconds": 715600.224893, "max_seconds": 715600.224893, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T07:35:20.438Z", "date_only": false, "value": "2026-11-05T07:35:20.438Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T14:22:00.662Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 602511.662893, "hours": 167.3643508036111, "days": 6.973514616817129, "min_seconds": 602511.662893, "max_seconds": 602511.662893, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-06T15:00:09Z", "date_only": false, "value": "2026-11-06T15:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109349", "record": "CVE-2026-100109", "field": "creation_timestamp", "uuid": "edc07741-222f-44e0-a3b2-da04970da350", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-100109-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a thiscitze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-06 13:31:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-100109 - Security For WooCommerce 1.0.10-1.0.16 unauthenticated admin creation (PoC by thiscitze)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109349", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-13T14:22:00.662Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}