Description

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T06:17:37.887Z",
  "pubdate": "2026-08-13T06:17:37.887Z",
  "executiveSummary": "An authentication bypass vulnerability exists in the Customer Email Verification for WooCommerce WordPress plugin affecting versions prior to 3.2.6.\nThe flaw stems from improper validation of the email-verification activation code, specifically utilizing a loose comparison mechanism during the verification process.\nAn unauthenticated attacker can exploit this weakness by supplying a crafted value type that satisfies the loose type comparison, successfully bypassing the cryptographic or token-based validation checks.\nThe primary impact of this vulnerability is complete account takeover, enabling malicious actors to verify and compromise any registered user account that has not yet confirmed its email address.\nNo privileges or prior authentication are required to execute the attack, lowering the exploitation barrier and exposing unverified user accounts to immediate compromise.\nSystem administrators running vulnerable versions of the plugin face significant risk regarding user data confidentiality and integrity, as unauthorized actors can hijack accounts before legitimate owners complete registration confirmation.",
  "technicalDetails": "The root cause of the vulnerability lies in the activation code verification logic within the Customer Email Verification for WooCommerce plugin prior to version 3.2.6.\nThe vulnerable component implements a loose comparison operator (such as PHP's '==' instead of strict comparison '===') when validating the user-supplied activation code against the stored verification token associated with the target account.\nBecause PHP evaluates loose comparisons by performing type juggling, an attacker can manipulate the input parameter using a crafted value type—such as a boolean, an integer, or an array—that evaluates to true when compared loosely against the expected string or numeric token.\nThe attack flow proceeds as follows: First, the attacker identifies a registered user account that remains unverified and possesses a pending email-verification activation link or parameter.\nSecond, the attacker crafts a malicious HTTP request targeting the verification endpoint, substituting the legitimate activation code with the crafted value type designed to trigger the loose comparison flaw.\nThird, the vulnerable verification function processes the input, and due to the insecure evaluation, incorrectly authenticates the code as a valid match for the target user ID.\nFinally, the application marks the targeted email address as verified and grants the attacker unauthorized access, leading to full account takeover.\nThe vulnerability requires network exposure via the web interface and can be exploited entirely without authentication or privileges against any instance running affected versions below 3.2.6."
}