The vulnerability is a flaw in MoreConvert Pro's guest waitlist verification flow that neglects to invalidate or regenerate verification tokens when a customer email is altered. As a result, an attacker who has already collected a verification token for an email controlled by them can later change the guest customer's email address to that of a target user through the public waitlist interface. Using the original token, the attacker authenticates as the target, including privileged administrator users. This bypass of authentication directly compromises the confidentiality and integrity of the entire WordPress site, allowing full control of content, settings, and potentially the underlying database.

This flaw affects all published releases of the MoreConvert Pro WordPress plugin up to and including version 1.9.14. All installations of MoreConvert Pro that have not been patched beyond that version are vulnerable and should be treated as at risk.

The CVSS score of 9.8 categorizes it as Critical, and while the EPSS score is not currently available, the lack of a known KEV listing does not diminish the potential for rapid exploitation. The attack path requires only a public-facing request to the waitlist endpoint; no privileged credentials or complex configuration are needed. Consequently, unauthenticated users can readily perform the token reuse and elevate themselves to administrator status. Immediate remediation is strongly recommended.