---
id: "CVE-2026-109236"
kind: "vulnerability"
aliases: ["CVE-2026-109236"]
title: "WordPress WooCommerce email verification plugin lets attackers log in unauthenticated"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["fresh-install-2.8.2", "plugin-not-installed"]
published_at: "2026-10-28T06:16:33+00:00"
first_seen_at: "2026-10-28T06:31:26+00:00"
updated_at: "2026-10-28T06:32:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109236", "first_seen_at": "2026-10-28T06:31:26+00:00"}]
---

# WordPress WooCommerce email verification plugin lets attackers log in unauthenticated

The Customer Email Verification for WooCommerce plugin predicts its email-verification token as md5(email . time()) and exposes the needed nonce to all visitors, so an attacker can log in as a customer bound to any email address or mark an account verified. Exploitation depends on an upgraded site where the cev_user_log table still has a password column.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Customer Email Verification for WooCommerce plugin in the WordPress admin plugin list or `wp plugin get customer-email-verification --field=version` (the plugin slug is unknown from the sources; confirm it).
- Check whether the `cev_user_log` table has a `password` column, for example with `wp db query "DESCRIBE cev_user_log;"` (table name from the description; the prefix may differ).

## Fix

- Update the Customer Email Verification for WooCommerce plugin to a version later than `2.8.2` (the patched version is unknown from the sources; check the vendor or NVD listing).
- Until updated, deactivate the plugin if customer email verification is not required.

## Timeline

- 2026-10-28T06:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109236

## From the sources

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_