{"id":"CVE-2026-109236","kind":"vulnerability","aliases":["CVE-2026-109236"],"related":[],"title":"WordPress WooCommerce email verification plugin lets attackers log in unauthenticated","description":"The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.","summary":"The Customer Email Verification for WooCommerce plugin predicts its email-verification token as md5(email . time()) and exposes the needed nonce to all visitors, so an attacker can log in as a customer bound to any email address or mark an account verified. Exploitation depends on an upgraded site where the cev_user_log table still has a password column.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["fresh-install-2.8.2","plugin-not-installed"],"how_to_check":"- Check the installed version of the Customer Email Verification for WooCommerce plugin in the WordPress admin plugin list or `wp plugin get customer-email-verification --field=version` (the plugin slug is unknown from the sources; confirm it).\n- Check whether the `cev_user_log` table has a `password` column, for example with `wp db query \"DESCRIBE cev_user_log;\"` (table name from the description; the prefix may differ).","fix":"- Update the Customer Email Verification for WooCommerce plugin to a version later than `2.8.2` (the patched version is unknown from the sources; check the vendor or NVD listing).\n- Until updated, deactivate the plugin if customer email verification is not required.","status":"open","published_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:22+00:00","updated_at":"2026-10-28T06:32:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Customer Email Verification for WooCommerce plugin to a version later than `2.8.2` (the patched version is unknown from the sources; check the vendor or NVD listing).\n- Until updated, deactivate the plugin if customer email verification is not required.","reach":"internet","title":"WordPress WooCommerce email verification plugin lets attackers log in unauthenticated","impact":"medium","summary":"The Customer Email Verification for WooCommerce plugin predicts its email-verification token as md5(email . time()) and exposes the needed nonce to all visitors, so an attacker can log in as a customer bound to any email address or mark an account verified. Exploitation depends on an upgraded site where the cev_user_log table still has a password column.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker logs in as any customer account or verifies accounts","analyst_note":"Confirm the patched plugin version and the plugin slug from the NVD entry or the WordPress plugin repository; the sources give neither.","how_to_check":"- Check the installed version of the Customer Email Verification for WooCommerce plugin in the WordPress admin plugin list or `wp plugin get customer-email-verification --field=version` (the plugin slug is unknown from the sources; confirm it).\n- Check whether the `cev_user_log` table has a `password` column, for example with `wp db query \"DESCRIBE cev_user_log;\"` (table name from the description; the prefix may differ).","needs_analyst":true,"not_affected_if":["plugin-not-installed","fresh-install-2.8.2"],"who_is_affected":"Sites running the Customer Email Verification for WooCommerce plugin version 2.8.2 or earlier that were upgraded from an older version where the cev_user_log table gained a password column. Fresh installs of 2.8.2 do not have that column, so the bypass path described in the sources does not apply to them, though the unauthenticated flaw is still present in the code. Sites not running this plugin can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":3614,"output_tokens":757,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109236':13A,16A '-2026':12A,15A '2.8.2':112C,257C 'absent':247C 'account':65B,215C 'action':128C 'address':61B,209C 'ajax':170C 'arbitrari':207C 'attack':7A,50B,193C 'authent':96C,118C 'bound':57B,204C 'bypass':97C,224C 'capabl':140C 'cev':75B,236C 'check':141C 'code':148C 'column':83B,244C,270C 'contain':241C 'control':232C 'core':228C 'creat':200C 'cusom':133C 'custom':24B,56B,85C,203C,217C 'cve':11A,14A 'defin':272C 'depend':68B 'due':115C 'email':3A,25B,33B,38B,60B,86C,102C,121C,134C,155C,208C,218C,230C 'email-verif':32B,101C,229C 'emit':176C 'end':181C 'everi':178C 'exist':214C 'exploit':67B,233C 'expos':41B 'flip':212C 'fresh':251C 'fresh-instal':250C 'front':180C 'front-end':179C 'fulli':223C 'function':123C 'generat':152C 'get':136C 'handler':174C 'hook':124C 'host':20B 'includ':111C 'instal':252C 'issuanc':166C 'lack':138C 'let':6A 'link':122C 'local':185C 'log':8A,52B,77B,195C,238C 'make':188C 'mark':63B 'md5':37B,154C 'meta':220C 'need':43B 'newli':199C 'nonc':44B,143C,161C 'nopriv':171C 'older':266C 'otp':160C,173C 'packag':17B 'paramet':137C 'password':82B,243C 'plugin':5A,29B,90C,226C 'possibl':190C 'predict':30B,100C 'present':260C 'requir':162C,234C 'resend':172C 'schema':253C 'script':186C 'secret':147C 'self':19B 'self-host':18B 'ship':254C 'site':72B,262C 'still':79B 'tabl':78B,239C 'time':39B,156C 'token':35B,104C,165C 'trigger':130C,164C 'unauthent':10A,192C 'upgrad':71B,263C 'user':76B,119C,237C 'valid':150C 'verif':4A,26B,34B,87C,103C,144C,231C 'verifi':66B,135C,159C,201C,219C,222C 'version':107C,256C,267C 'via':98C,167C 'visitor':47B,182C 'vulner':94C 'woocommerc':2A,21B,28B,89C,202C 'wordpress':1A,22B,92C 'wp':127C,169C,184C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Customer Email Verification for WooCommerce plugin version 2.8.2 or earlier that were upgraded from an older version where the cev_user_log table gained a password column. Fresh installs of 2.8.2 do not have that column, so the bypass path described in the sources does not apply to them, though the unauthenticated flaw is still present in the code. Sites not running this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109236","severity":null,"published_at":"2026-10-28T06:16:33+00:00","modified_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}