# Customer Email Verification for WooCommerce <= 2.8.1 - Authenticated (Contributor+) Missing Authorization to Arbitrary User Email Verification Status Modification

- **ID:** WPSEC-2026-0644
- **Plugin:** Customer Email Verification for WooCommerce (`customer-email-verification-for-woocommerce`), https://wordpress.org/plugins/customer-email-verification-for-woocommerce/
- **Affected versions:** from 1.0 before 2.8.2
- **Fixed in:** 2.8.2 (Update to 2.8.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0644/

## Description

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.8.1. This is due to a missing capability check on the cev_manualy_user_verify_in_user_menu AJAX action and the cev_manual_verify_user function. Both act on any user ID supplied in the request and are protected only by a nonce that the plugin shows to users on their own profile page. This makes it possible for authenticated attackers, with Contributor-level access and above, to mark any other user's email address as verified or unverified and to send verification emails to arbitrary users. On sites that let customers or subscribers into the WordPress dashboard, those roles can do the same.

## References

- https://wpsec.com/vuln/WPSEC-2026-0644/
- https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.2/
- https://wordpress.org/plugins/customer-email-verification-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0644/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.