What is the CVSS score of CVE-2026-5722?

CVE-2026-5722 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MoreConvert Pro are affected by CVE-2026-5722?

MoreConvert Pro for WordPress versions 1.9.14 and earlier contain a critical authentication bypass vulnerability (CVSS 9.8) that allows remote attackers to hijack any user account, including…

How to fix or mitigate CVE-2026-5722?

Within 24 hours: disable MoreConvert Pro plugin immediately via WordPress admin or remove plugin files; audit WordPress user accounts for unauthorized changes or logins. Within 7 days: contact MoreConvert Pro vendor to confirm patch availability and timeline; review access logs for suspicious authentication patterns; consider switching to alternative waitlist/conversion plugins if patch is not released. Within 30 days: once vendor patch is released and validated in a test environment, apply immediately and re-enable the plugin; reset all WordPress user passwords; review and strengthen authentication controls (MFA, IP restrictions).

MoreConvert Pro CVE-2026-5722

EUVD-2026-27167 CRITICAL

Improper Authentication (CWE-287)

2026-05-05 Wordfence

Authentication Bypass WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 02:30 vuln.today

DescriptionCVE.org

The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.9.14. This is due to the guest waitlist verification flow not invalidating or regenerating verification tokens when the customer email address is changed. This makes it possible for unauthenticated attackers to authenticate as existing users, including administrators, by obtaining a valid guest verification token for an attacker-controlled email, changing the same guest customer email to the target account email through the public waitlist flow, and then using the original verification link.

AnalysisAI

Authentication bypass in MoreConvert Pro for WordPress allows remote unauthenticated attackers to hijack any user account, including administrators, by exploiting token reuse in the guest waitlist verification flow. Attackers obtain a verification token for their own email, change the guest customer email to the target victim's email via the public waitlist API, then use the original token to authenticate as the victim. This critical vulnerability (CVSS 9.8) affects all versions through 1.9.14, with network-accessible, low-complexity exploitation requiring no privileges or user interaction. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis.

Technical ContextAI

MoreConvert Pro is a WordPress e-commerce plugin providing waitlist and wishlist functionality. The vulnerability resides in CWE-287 (Improper Authentication) where the guest waitlist verification mechanism fails to implement proper token lifecycle management. When a guest user requests waitlist access, the system generates a verification token tied to the requester's email. The flaw occurs because the token remains valid even after the associated email address is changed through the public waitlist API endpoint. This violates the security principle that authentication tokens must be invalidated when the identity they authenticate changes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a remotely exploitable authentication bypass requiring no special conditions, allowing complete account takeover with full confidentiality, integrity, and availability impact.

RemediationAI

Immediately upgrade MoreConvert Pro to version 1.9.15 or later if available, per the vendor changelog at https://moreconvert.com/changelog/. WordPress administrators should check the plugin repository at https://wordpress.org/plugins/smart-wishlist-for-more-convert/ for the latest patched version and apply updates through the WordPress admin dashboard under Plugins → Updates. If no patch is available or immediate upgrade is not feasible, implement these compensating controls with understanding of their limitations: temporarily deactivate the MoreConvert Pro plugin entirely until patched (disrupts waitlist functionality for customers), restrict access to WordPress admin panels through IP allowlisting at web server or firewall level (mitigates admin account hijacking but does not prevent lower-privilege account compromise), implement web application firewall rules to block suspicious patterns in guest waitlist API requests such as rapid email changes for the same session (may generate false positives and requires deep packet inspection capability). Monitor WordPress user login activity for unexpected administrator access and enable two-factor authentication for all administrative accounts to add defense-in-depth, though this does not prevent the initial authentication bypass. Note that WAF rules and access restrictions only reduce attack surface and do not fix the underlying token validation flaw.