high advisory October 16, 2026

CVE-2026-104745 - Privilege Escalation in Customer Email Verification for WooCommerce

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthenticated privilege escalation due to insufficient entropy in activation token generation when configured to use the 'hashids' encoding method.

The Customer Email Verification for WooCommerce plugin for WordPress, in versions up to and including 3.3.0, contains a critical security flaw that allows for unauthenticated privilege escalation. When the plugin is configured with the 'hashids' encoding method, it generates per-user activation secrets using the wp_rand(100) function. This results in an extremely low entropy of approximately 101 possible values, or 7 bits. Because these tokens are generated via reversible Hashids encoding without a cryptographic MAC, and because the verification handler hooked to the WordPress init action lacks nonce verification or rate limiting, an attacker can brute-force the activation code space. By supplying a forged alg_wc_ev_verify_email GET parameter, an unauthenticated attacker can verify and hijack unverified accounts, including those with administrative privileges, provided the attacker can recover or guess the Hashids salt, which typically defaults to an md5(time()) value generated at initial setup.

Impact

Successful exploitation allows an unauthenticated attacker to hijack any unverified WordPress account, including administrator accounts. This leads to full administrative control over the WordPress instance, enabling arbitrary code execution, data exfiltration, and full site compromise. This vulnerability impacts all WordPress environments utilizing the specified plugin version with the non-default 'hashids' configuration enabled.

Recommendation

Update the 'Customer Email Verification for WooCommerce' plugin to the latest version patched against CVE-2026-104745.
If patching is not immediately feasible, change the plugin's 'Encoding method' from 'hashids' to a more secure alternative or disable the plugin entirely.
Audit the WordPress user database for unverified accounts that could be targeted for hijacking.
Monitor web server logs for high-frequency GET requests containing the alg_wc_ev_verify_email parameter targeting the WordPress home directory or specific verification endpoints.

Immediate actions

Audit user accounts for unverified status and ensure plugin is patched or disabled.

IT Operations 24h

Threat Hunt

Search web logs for high-frequency access to the alg_wc_ev_verify_email parameter.

T1595.002 high high confidence convert to detection

Data: webserver access logs

Mitigations

Update Customer Email Verification for WooCommerce plugin to version > 3.3.0 or change 'Encoding method' setting.

immediate IT Operations

CVE-2026-104745

Detection coverage 1

Detect CVE-2026-104745 Exploitation - Brute Force Attempt on Email Verification

high

Detects high-frequency access to the verification parameter indicating potential brute-force attempts against the weak token generation mechanism.

sigma tactics: privilege_escalation techniques: T1595.002 sources: webserver

Detection queries are available on the platform. Get full rules →