Unauthorized Access Vulnerability in Germanized for WooCommerce Plugin by WooCommerce

CVE-2026-109231

What is CVE-2026-109231?

The Germanized for WooCommerce plugin for WordPress exhibits a vulnerability allowing unauthorized access to private customer data due to improper token management. Specifically, an on_user_email_changed hook that should rotate activation tokens for unactivated user accounts is only registered under certain conditions. If 'Disable login for unactivated customers' is set to No, the original activation token remains valid and can be exploited by authenticated attackers with at least Subscriber-level access. Attackers can change their account email to a victim's billing email via the account edit form and then use their activation token to gain unauthorized access to the victim's orders, exposing sensitive information like billing names, addresses, and purchased items. This exploitation requires specific configuration settings, including the enabling of public customer registration and double opt-in features.

References