CVE-2026-109236

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticate_user_by_email_link() function — hooked on the wp action and triggered by the cusomer_email_verify GET parameter — lacking any capability check or nonce verification, while the secret_code it validates is generated as md5(email . time()) and the verify_otp_nonce required to trigger token issuance via the wp_ajax_nopriv_resend_otp handler is emitted to every front-end visitor through wp_localize_script. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's customer_email_verified meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the cev_user_log table to contain a password column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticate_user_by_email_link() function — hooked on the wp action and triggered by the cusomer_email_verify GET parameter — lacking any capability check or nonce verification, while the secret_code it validates is generated as md5(email . time()) and the verify_otp_nonce required to trigger token issuance via the wp_ajax_nopriv_resend_otp handler is emitted to every front-end visitor through wp_localize_script. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's customer_email_verified meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the cev_user_log table to contain a password column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticate_user_by_email_link() function — hooked on the wp action and triggered by the cusomer_email_verify GET parameter — lacking any capability check or nonce verification, while the secret_code it validates is generated as md5(email . time()) and the verify_otp_nonce required to trigger token issuance via the wp_ajax_nopriv_resend_otp handler is emitted to every front-end visitor through wp_localize_script. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's customer_email_verified meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the cev_user_log table to contain a password column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticate_user_by_email_link() function — hooked on the wp action and triggered by the cusomer_email_verify GET parameter — lacking any capability check or nonce verification, while the secret_code it validates is generated as md5(email . time()) and the verify_otp_nonce required to trigger token issuance via the wp_ajax_nopriv_resend_otp handler is emitted to every front-end visitor through wp_localize_script. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's customer_email_verified meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the cev_user_log table to contain a password column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.