Authentication Bypass Vulnerability in MoreConvert Pro Plugin for WordPress

CVE-2026-5722

What is CVE-2026-5722?

The MoreConvert Pro plugin for WordPress is susceptible to an authentication bypass flaw due to improper handling of guest waitlist verification. This vulnerability allows unauthenticated attackers to exploit the token validation process. If an attacker modifies the customer email address in the guest verification flow, they can retain access by using the originally issued verification link. This poses significant risks, potentially allowing access to sensitive user accounts, including those of administrators, if an attacker can successfully manipulate the verification tokens.

References