Email Verification and Authentication Bypass Vulnerability Affects WooCommerce Customers

CVE-2024-4185

Summary

The Customer Email Verification for WooCommerce plugin for WordPress is susceptible to an Email Verification and Authentication Bypass vulnerability, affecting all versions up to and including version 2.7.4. This vulnerability arises from the utilization of an insufficiently random activation code, which allows unauthenticated attackers to circumvent email verification processes. Furthermore, if both options for 'Login the user automatically after the account is verified' and 'Verify account for current users' are enabled, attackers can potentially bypass authentication measures for previously registered users, raising serious security concerns for the integrity of user accounts.

References