CVE-2026-109236

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.

• CWE-287

• https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L119
• https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L151
• https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L274
• https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L580
• https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.2/includes/class-wc-customer-email-verification-signup.php#L616
• https://plugins.trac.wordpress.org/browser/customer-email-verification-for-woocommerce/tags/2.8.3/includes/class-wc-customer-email-verification-signup.php
• https://wordpress.org/plugins/customer-email-verification-for-woocommerce/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e9fa74-5501-4429-a500-1d4199571a34?source=cve

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109228SGLang through 0.5.21 contains a resource budget bypass vuln…7.5
• CVE-2026-109229SGLang through 0.5.21 contains a denial of service vulnerabi…7.5
• CVE-2026-10923Use after free in WebAppInstalls in Google Chrome on Android…8.8
• CVE-2026-109231The Germanized for WooCommerce plugin for WordPress is vulne…4.3
• CVE-2026-109232The Salon Booking System – Appointment Booking for Salons, B…7.2
• CVE-2026-109234The Meow Lightbox plugin for WordPress is vulnerable to Stor…7.2
• CVE-2026-109237Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-confi…8.1
• CVE-2026-109238Crawl4AI 0.7.0 before 0.9.4 contains a server-side request f…8.6
• CVE-2026-109239Crawl4AI before 0.9.4 contains a blind server-side request f…5.3
• CVE-2026-10924Integer overflow in Chromecast in Google Chrome prior to 149…8.3
• CVE-2026-109240FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion …3.1
• CVE-2026-109241FreeRDP before 3.32.0 contains a NULL pointer dereference vu…3.1