# Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via OTP Brute Force

- **ID:** WPSEC-2026-1432
- **Plugin:** Customer Email Verification for WooCommerce (`customer-email-verification-for-woocommerce`), https://wordpress.org/plugins/customer-email-verification-for-woocommerce/
- **Affected versions:** from 2.3 before 2.8.3
- **Fixed in:** 2.8.3 (Update to 2.8.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1432/

## Description

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification Bypass via the 'verify_otp' AJAX action in all versions up to, and including, 2.8.2, due to the absence of any limit on incorrect signup OTP guesses per email address. The verification code is 4 digits by default, and the nonce the action requires is printed on every front-end page. This makes it possible for unauthenticated attackers to brute force the code sent to an email address they do not control and register an account for that address that is marked as verified.

## References

- https://wpsec.com/vuln/WPSEC-2026-1432/
- https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.3/
- https://wordpress.org/plugins/customer-email-verification-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1432/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.