EUVD-2026-57726
GHSA-pr3v-3whj-72rg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network, no-interaction type-juggling bypass gives full control of a targeted account (C:H/I:H); availability is unaffected, so A:N rather than the record's A:H.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
Articles & Coverage 1
AnalysisAI
Account takeover in the Customer Email Verification for WooCommerce WordPress plugin (versions 2.4.0 through 3.2.5) lets unauthenticated attackers hijack any registered user who has not yet confirmed their email. The plugin validates the email-activation code with a loose (type-juggling) comparison, so a crafted value type satisfies the check without knowing the real code, marking the target account as verified under attacker control. Rated CVSS 9.8 with a patch available in 3.2.6; no public exploit is identified at time of analysis and EPSS is low (0.15%).
Technical ContextAI
The affected component is a WordPress/WooCommerce plugin that gates new-account activation behind an emailed verification code. The root cause is CWE-287 (Improper Authentication) driven by PHP's loose equality: comparing the user-supplied code to the stored code with '' rather than a strict, type-safe comparison (e.g. hash_equals() or '='). PHP loose comparison performs type coercion, so values such as a boolean true, the integer 0, or 'magic hash' strings can equate to unrelated stored values, letting an attacker supply a crafted type that the comparison accepts as valid. Because verification is the trust boundary that binds an email address to an account, bypassing it confers control of the pre-confirmation account.
RemediationAI
Vendor-released patch: upgrade the Customer Email Verification for WooCommerce plugin to version 3.2.6 or later, which replaces the loose comparison with a correct validation of the activation code; this is the primary and complete fix. If you cannot patch immediately, reduce exposure by disabling new-user self-registration on WooCommerce/WordPress (WooCommerce 'Allow customers to create an account during checkout' and WordPress 'Anyone can register') so no unconfirmed accounts exist to hijack - the trade-off is loss of self-service signup. As an interim monitoring control, audit for accounts that transitioned to 'verified' without a matching verification event and force a password reset on any recently confirmed accounts. Refer to the WPScan advisory (https://wpscan.com/vulnerability/ef4e95a3-6f90-4423-9551-9ac28f7b6291/) for details.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today