Customer Email Verification for WooCommerce <= 2.8.1 - Authenticated (Contributor+) Missing Authorization to Arbitrary User Email Verification Status Modification
- ID
- WPSEC-2026-0644
- Plugin
- Customer Email Verification for WooCommerce (customer-email-verification-for-woocommerce)
- Affected
- from 1.0 before 2.8.2
- Remediation
- Update to 2.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-08
- Attack surface
- Customer Email Verification for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.8.1. This is due to a missing capability check on the cev_manualy_user_verify_in_user_menu AJAX action and the cev_manual_verify_user function. Both act on any user ID supplied in the request and are protected only by a nonce that the plugin shows to users on their own profile page. This makes it possible for authenticated attackers, with Contributor-level access and above, to mark any other user's email address as verified or unverified and to send verification emails to arbitrary users. On sites that let customers or subscribers into the WordPress dashboard, those roles can do the same.
References
- https://wpsec.com/vuln/WPSEC-2026-0644/
- https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.2/
- https://wordpress.org/plugins/customer-email-verification-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS