CVE-2026-104745: Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode() generates the per-user activation secret using wprand(100) when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated verify() handler — hooked to init at PHPINTMAX with no nonce check and no rate limiting — accepts and acts on the attacker-controlled ?algwcevverifyemail= GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an md5(time()) value set at first initialization), and that the target account's email address remain unverified.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed to this attack path?
The vulnerable path requires the plugin's Encoding method to be set to hashids, which is not the default configuration. It also requires an unverified WordPress account to target; that account may have administrator-level privileges.
What does an attacker need to exploit it?
An attacker does not need to authenticate or obtain user interaction. They need to recover or brute-force the Hashids salt and brute-force the per-user activation code space, which has only about 101 possible values when hashids is used.
Are there controls that limit verification attempts?
The verification handler accepts the attacker-controlled alg_wc_ev_verify_email GET parameter directly. It has no nonce check and no rate limiting, allowing repeated forged verification attempts.