Vulnerabilities / Customer Email Verification for WooCommerce / WPSEC-2026-1432
Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via OTP Brute Force
Medium 5.3
CWE-307Fixed in 2.8.3
- ID
- WPSEC-2026-1432
- Plugin
- Customer Email Verification for WooCommerce (customer-email-verification-for-woocommerce)
- Affected
- from 2.3 before 2.8.3
- Remediation
- Update to 2.8.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Customer Email Verification for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification Bypass via the 'verify_otp' AJAX action in all versions up to, and including, 2.8.2, due to the absence of any limit on incorrect signup OTP guesses per email address. The verification code is 4 digits by default, and the nonce the action requires is printed on every front-end page. This makes it possible for unauthenticated attackers to brute force the code sent to an email address they do not control and register an account for that address that is marked as verified.
References
- https://wpsec.com/vuln/WPSEC-2026-1432/
- https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.3/
- https://wordpress.org/plugins/customer-email-verification-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS