{
 "id": "WPSEC-2026-1432",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1432/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1432/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1432/index.md",
 "title": "Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via OTP Brute Force",
 "description": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification Bypass via the 'verify_otp' AJAX action in all versions up to, and including, 2.8.2, due to the absence of any limit on incorrect signup OTP guesses per email address. The verification code is 4 digits by default, and the nonce the action requires is printed on every front-end page. This makes it possible for unauthenticated attackers to brute force the code sent to an email address they do not control and register an account for that address that is marked as verified.",
 "plugin": {
  "slug": "customer-email-verification-for-woocommerce",
  "name": "Customer Email Verification for WooCommerce",
  "full_name": "Customer Email Verification for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/customer-email-verification-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/customer-email-verification-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.3",
    "from_inclusive": true,
    "to": "2.8.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.3 before 2.8.3"
  ]
 },
 "introduced_in": "2.3",
 "fixed_in": "2.8.3",
 "remediation": "Update to 2.8.3 or later.",
 "fix_released": "2026-10-21T09:42:19+00:00",
 "published": "2026-10-22T09:43:07+00:00",
 "updated": "2026-10-21T12:22:52.449712+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1432/",
  "https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.3/",
  "https://wordpress.org/plugins/customer-email-verification-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}