CVE-2026-109236
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Customer Email Verification for WooCommerce plugin in versions up to and including 2.8.2 is vulnerable to Authentication Bypass via a Predictable Email-Verification Token. The authenticate_user_by_email_link() function lacks capability and nonce checks, and the token is generated as md5(email . time()), allowing unauthenticated attackers to log in as a newly created customer or mark an account as verified.
Risk Assessment
An attacker can take over WooCommerce customer accounts bound to an arbitrary email address, bypassing the plugin's email-verification control. Exploitation requires the cev_user_log table to contain a password column, which is present only on sites upgraded from older versions.
Recommendation
Update the plugin to a version newer than 2.8.2. On sites migrated from older versions, verify the cev_user_log table schema and remove the unnecessary password column.
Other vulnerabilities in Customer Email Verification for WooCommerce
See all- CVE-2026-14182Critical
The Customer Email Verification for WooCommerce WordPress plugin before version 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
- CVE-2026-104745High
The Customer Email Verification for WooCommerce plugin (versions up to and including 3.3.0) is vulnerable to privilege escalation via the 'alg_wc_ev_verify_email' parameter. The activation code is generated using wp_rand(100), yielding only ~101 possible values, and the verify() handler lacks nonce checks and rate limiting.
Original NVD description (English source)
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS