{
 "id": "WPSEC-2026-0644",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0644/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0644/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0644/index.md",
 "title": "Customer Email Verification for WooCommerce <= 2.8.1 - Authenticated (Contributor+) Missing Authorization to Arbitrary User Email Verification Status Modification",
 "description": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.8.1. This is due to a missing capability check on the cev_manualy_user_verify_in_user_menu AJAX action and the cev_manual_verify_user function. Both act on any user ID supplied in the request and are protected only by a nonce that the plugin shows to users on their own profile page. This makes it possible for authenticated attackers, with Contributor-level access and above, to mark any other user's email address as verified or unverified and to send verification emails to arbitrary users. On sites that let customers or subscribers into the WordPress dashboard, those roles can do the same.",
 "plugin": {
  "slug": "customer-email-verification-for-woocommerce",
  "name": "Customer Email Verification for WooCommerce",
  "full_name": "Customer Email Verification for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/customer-email-verification-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/customer-email-verification-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.0",
    "from_inclusive": true,
    "to": "2.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.0 before 2.8.2"
  ]
 },
 "introduced_in": "1.0",
 "fixed_in": "2.8.2",
 "remediation": "Update to 2.8.2 or later.",
 "fix_released": "2026-10-07T11:36:58+00:00",
 "published": "2026-10-08T11:45:37+00:00",
 "updated": "2026-10-07T14:56:16.290892+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0644/",
  "https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.2/",
  "https://wordpress.org/plugins/customer-email-verification-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-08"
 }
}