Authentication Bypass in Customer Email Verification for WooCommerce Plugin by WordPress

CVE-2026-109236

What is CVE-2026-109236?

The Customer Email Verification for WooCommerce plugin for WordPress suffers from an authentication bypass vulnerability due to a predictable email-verification token. This issue stems from the authenticate_user_by_email_link() function, which does not implement necessary capability checks or nonce verification. The secret_code utilized for validation is generated in a manner that makes it easy for attackers to exploit. This allows unauthenticated users to potentially log in as a newly registered or existing verified customer, undermining the intended email-verification functionality. This vulnerability affects all versions of the plugin up to and including version 2.8.2. Notably, exploitation may require the presence of a password column in the cev_user_log table, which is typically absent in fresh installations of version 2.8.2 but may exist on upgraded sites.

References