The Customer Email Verification for WooCommerce plugin is vulnerable because its email‑verification endpoint accepts a GET parameter without proper authorization checks or nonce verification, and the secret code it validates is generated from an easily predictable md5 hash of the user’s email and the current time. This flaw allows any unauthenticated visitor to craft a verification link that, when processed, marks a newly created customer or flips an existing account’s customer_email_verified flag, effectively bypassing the plugin’s core email‑verification control and enabling an attacker to impersonate the customer. The impact includes unauthorized access to personal data, order history, and purchasing capabilities, compromising confidentiality, integrity, and e‑commerce functionality.

WordPress sites that have installed the zorem Customer Email Verification for WooCommerce plugin version 2.8.2 or earlier are affected. The vulnerability is exploitable only on installations that upgraded from earlier releases and therefore retain the obsolete cev_user_log table with a password column; fresh installs of 2.8.2 do not expose this column, limiting the attack surface to legacy database schemas that still contain the password field.

The CVSS score of 4.8 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attackers can reach the vulnerable endpoint from the public internet by sending a crafted request to the cusomer_email_verify query parameter. Successful exploitation would allow an unauthenticated attacker to impersonate a customer on affected WordPress sites, potentially accessing sensitive personal information and performing fraudulent purchases.