What the vulnerability does
01Description
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.
Explanation of Vulnerability in Simple Terms
02Summary
The Customer Email Verification for WooCommerce plugin through version 2.7.4 contains a cryptographic weakness in its random token generation. An attacker can predict or brute-force email verification tokens, allowing them to verify email addresses without authorization. This bypasses the plugin's core security mechanism and could enable account takeover or unauthorized access to customer accounts.
What an attacker can do
03Attacker Capabilities
Predict or brute-force email verification tokens to verify accounts without authorization.
Potential impact on your site
04Site Impact
Customer accounts can be verified and accessed by attackers without legitimate email confirmation.
Conditions required to exploit
05Prerequisites
Network access to the WooCommerce site; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 30, 2024
CVE published
April 8, 2026
Record updated
