Live › vulnerability › CVE-2026-109236
Go to dashboardThe Customer Email Verification for WooCommerce plugin predicts its email-verification token as md5(email . time()) and exposes the needed nonce to all visitors, so an attacker can log in as a customer bound to any email address or mark an account verified. Exploitation depends on an upgraded site where the cev_user_log table still has a password column.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Customer Email Verification for WooCommerce plugin version 2.8.2 or earlier that were upgraded from an older version where the cev_user_log table gained a password column. Fresh installs of 2.8.2 do not have that column, so the bypass path described in the sources does not apply to them, though the unauthenticated flaw is still present in the code. Sites not running this plugin can skip it.
No product ranges from the sources yet.
wp plugin get customer-email-verification --field=version (the plugin slug is unknown from the sources; confirm it).cev_user_log table has a password column, for example with wp db query "DESCRIBE cev_user_log;" (table name from the description; the prefix may differ).2.8.2 (the patched version is unknown from the sources; check the vendor or NVD listing).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticate_user_by_email_link() function — hooked on the wp action and triggered by the cusomer_email_verify GET parameter — lacking any capability check or nonce verification, while the secret_code it validates is generated as md5(email . time()) and the verify_otp_nonce required to trigger token issuance via the wp_ajax_nopriv_resend_otp handler is emitted to every front-end visitor through wp_localize_script. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's customer_email_verified meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the cev_user_log table to contain a password column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.
This page as .md · .json · in your agent: get_signal("CVE-2026-109236")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.