The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable…
CVE-2026-109236
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink() function — hooked on the wp action and triggered by the cusomeremailverify GET parameter — lacking any capability check or nonce verification, while the secretcode it validates is generated as md5(email . time()) and the verifyotpnonce required to trigger token issuance via the wpajaxnoprivresendotp handler is emitted to every front-end visitor through wplocalizescript. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's customeremailverified meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the cevuserlog table to contain a password column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.
Assessment
- CVSS
- 4.8 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 28 October 2026
- Weakness
- CWE-287
- Assigner
- security@wordfence.com
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
At the source
References
- https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L119
- https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L151
- https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L274
- https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L580
- https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L616
- https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.3/includes/class-wc-customer-email-verification-signup.php
- https://wordpress.org/plugins/customer-email-verification-for-woocommerce/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e9fa74-5501-4429-a500-1d4199571a34?source=cve
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-109236