Privilege Escalation Vulnerability in Customer Email Verification for WooCommerce by WordPress

CVE-2026-104745

What is CVE-2026-104745?

The Customer Email Verification for WooCommerce plugin is susceptible to a privilege escalation vulnerability due to improper use of activation codes. In versions up to and including 3.3.0, an attacker can exploit the alg_wc_ev_verify_email parameter alongside a misconfigured 'Encoding method' set to 'hashids'. The vulnerability arises from the use of a limited set of activation codes, resulting in a reversible encoding without cryptographic protections. This allows for unauthenticated access to unverified WordPress accounts, including potential administrative accounts, through brute force attacks on the activation code via crafted verification URLs. Adequate security measures, including nonce checks and rate limiting, are absent, further exacerbating this vulnerability.

References