Description
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.
Published: 2026-10-16
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The Customer Email Verification for WooCommerce plugin allows an unauthenticated attacker to gain full access to any unverified WordPress user account, including administrators, by exploiting the alg_wc_ev_verify_email parameter. The vulnerability arises because the plugin’s hashids encoding method produces a three‑digit token with only ~101 possibilities and no cryptographic protection. An attacker can brute‑force the token through a crafted verification URL and authenticate as the target user without needing a nonce or rate limiting. This results in complete loss of confidentiality and integrity for the compromised account.

Affected Systems

WordPress sites running the Customer Email Verification for WooCommerce plugin from the wpcodefactory vendor. Versions up to and including 3.3.0 are affected by this flaw.

Risk and Exploitability

The vulnerability scores a CVSS of 8.1, indicating high severity. The EPSS score is not available, and it is not yet listed in the CISA KEV catalog. The exploit requires no pre‑authentication and relies on simple brute force against a very small token space, making it highly likely to be attempted by automated attackers. The attack vector is inferred to be a remote GET request to the site’s front‑end, with no client authentication or nonce validation required.

Generated by OpenCVE AI on October 16, 2026 at 13:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Customer Email Verification for WooCommerce to any version newer than 3.3.0 to eliminate the vulnerable token generation logic.
  • If upgrading immediately is not possible, reconfigure the plugin to use the default encoding method instead of hashids, or disable the hashids feature if not needed.
  • Ensure that all user accounts have verified email addresses before allowing them to transact, and consider implementing rate limiting on the verification endpoint to mitigate brute‑force attempts.

Generated by OpenCVE AI on October 16, 2026 at 13:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Description The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.
Title Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-16T15:09:41.042Z

Reserved: 2026-10-02T12:04:27.373Z

Link: CVE-2026-104745

cve-icon Vulnrichment

Updated: 2026-10-16T15:00:35.635Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T04:18:21.607

Modified: 2026-10-16T15:17:03.563

Link: CVE-2026-104745

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T13:52:50Z

Weaknesses
  • CWE-269

    Improper Privilege Management