Germanized for WooCommerce CVE-2026-109231

Exploitation requires all of the following: double opt-in enabled with 'Disable login for unactivated customers' explicitly set to No (a non-default setting that prevents the on_user_email_changed hook from rotating/rebinding the activation token); public customer registration enabled so the attacker can obtain a Subscriber account and an activation token; the attacker's original ?activate= token redeemed within its one-day expiry window; and the existence of a guest order whose billing email matches the victim email the attacker sets. The attacker must hold at least Subscriber-level authentication (PR:L). These conditions - especially the non-default configuration and the one-day token window plus a pre-existing matching guest order - substantially limit real-world exploitability despite the network attack vector.

This is a genuine but conditional privacy/authorization flaw (CWE-841, improper enforcement of behavioral workflow) rather than a high-urgency emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N scores 4.3 (Medium): network-reachable, low complexity, but requiring Subscriber-level authentication (PR:L) and no user interaction. The published scoring sets C:N despite the described outcome being disclosure of a victim's billing name, address, phone, and purchased items - this is a notable internal inconsistency, since 'Unauthorized Access of Private Data' is fundamentally a confidentiality harm; the I:L likely reflects the order-reassignment side effect. No EPSS probability was supplied, there is no CISA KEV listing (not actively exploited per available data), and no public exploit code or PoC reference was provided - only Wordfence threat-intel and plugin source/changeset links. The vuln.today decision label is 'this_month', consistent with a real-but-not-critical issue. The dominant risk limiter is configuration: exploitation requires a non-default setup (double opt-in enabled with 'Disable login for unactivated customers' set to No) plus public registration and a still-valid one-day token, materially narrowing the realistically exploitable population below what the network vector alone implies.

On a store running Germanized for WooCommerce (<=4.1.4) with double opt-in enabled but 'Disable login for unactivated customers' set to No, an attacker registers a normal Subscriber account, leaving its activation token unbound to any email. They edit their account email via /my-account/edit-account/ to a victim's billing email, then redeem their still-valid original ?activate= token, causing the plugin to reassign the victim's matching guest order to the attacker and expose the victim's billing PII on the attacker's My Account order page. No public exploit code was identified at time of analysis.