CVE-2026-109236: Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink() function — hooked on the wp action and triggered by the cusomeremailverify GET parameter — lacking any capability check or nonce verification, while the secretcode it validates is generated as md5(email . time()) and the verifyotpnonce required to trigger token issuance via the wpajaxnoprivresendotp handler is emitted to every front-end visitor through wplocalizescript. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's customeremailverified meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the cevuserlog table to contain a password column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.
Affected Software
Event History
Frequently Asked Questions
Which deployments are practically exposed to account login bypass?
The login-bypass path requires the plugin's cev_user_log table to have a password column. That column is absent from the version 2.8.2 fresh-install schema, but is present on sites upgraded from an older version where it was defined.
What does an unauthenticated attacker need to exploit this issue?
An attacker can obtain the verify_otp_nonce because it is emitted to every front-end visitor, then trigger token issuance through the unauthenticated resend_otp handler. The email-verification token is predictable because it is generated from md5(email . time()).
What can exploitation allow an attacker to do?
An attacker may log in as a newly created, verified WooCommerce customer associated with an arbitrary email address. They may also mark an existing account's customer_email_verified metadata as verified, bypassing the plugin's email-verification control.
How can I determine whether the login-bypass condition exists on my site?
Inspect the plugin's cev_user_log table for a password column. Its presence indicates the stated prerequisite for the authentication-bypass path, and may indicate an installation upgraded from an older plugin version.