{
 "id": "WPSEC-2026-0875",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0875/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0875/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0875/index.md",
 "title": "Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Email Verification Bypass via Activation Token Reuse",
 "description": "The Germanized for WooCommerce plugin for WordPress is vulnerable to Email Verification Bypass via the double opt-in account activation link in versions 4.1.0 up to, and including, 4.1.4. The activation key is not bound to the email address it was sent to, and the listener that resets verification when the account email changes is only registered when the 'disable login before activation' option is enabled. This makes it possible for authenticated attackers, with subscriber-level (customer) access and above, to register with an address they control, change the account email to an address they do not own, and then use the original activation link. The account is marked verified for an address they never proved they own, and guest orders placed with that address are linked to the attacker's account.",
 "plugin": {
  "slug": "woocommerce-germanized",
  "name": "Germanized for WooCommerce",
  "full_name": "Germanized for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-germanized/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-germanized/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-germanized"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.1.0",
    "from_inclusive": true,
    "to": "4.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.1.0 before 4.1.5"
  ]
 },
 "introduced_in": "4.1.0",
 "fixed_in": "4.1.5",
 "remediation": "Update to 4.1.5 or later.",
 "fix_released": "2026-10-13T08:01:39+00:00",
 "published": "2026-10-14T08:47:41+00:00",
 "updated": "2026-10-13T12:12:35.032917+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0875/",
  "https://plugins.svn.wordpress.org/woocommerce-germanized/tags/4.1.5/",
  "https://wordpress.org/plugins/woocommerce-germanized/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-germanized",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}