{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/customer-email-verification-for-woocommerce--3.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:alg_wc_ev:customer_email_verification_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-104745"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Customer Email Verification for WooCommerce (\u003c= 3.3.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","wordpress","privilege-escalation","cve-2026-104745"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Customer Email Verification for WooCommerce plugin for WordPress, in versions up to and including 3.3.0, contains a critical security flaw that allows for unauthenticated privilege escalation. When the plugin is configured with the 'hashids' encoding method, it generates per-user activation secrets using the \u003ccode\u003ewp_rand(100)\u003c/code\u003e function. This results in an extremely low entropy of approximately 101 possible values, or 7 bits. Because these tokens are generated via reversible Hashids encoding without a cryptographic MAC, and because the verification handler hooked to the WordPress \u003ccode\u003einit\u003c/code\u003e action lacks nonce verification or rate limiting, an attacker can brute-force the activation code space. By supplying a forged \u003ccode\u003ealg_wc_ev_verify_email\u003c/code\u003e GET parameter, an unauthenticated attacker can verify and hijack unverified accounts, including those with administrative privileges, provided the attacker can recover or guess the Hashids salt, which typically defaults to an \u003ccode\u003emd5(time())\u003c/code\u003e value generated at initial setup.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to hijack any unverified WordPress account, including administrator accounts. This leads to full administrative control over the WordPress instance, enabling arbitrary code execution, data exfiltration, and full site compromise. This vulnerability impacts all WordPress environments utilizing the specified plugin version with the non-default 'hashids' configuration enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the 'Customer Email Verification for WooCommerce' plugin to the latest version patched against CVE-2026-104745.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, change the plugin's 'Encoding method' from 'hashids' to a more secure alternative or disable the plugin entirely.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress user database for unverified accounts that could be targeted for hijacking.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high-frequency GET requests containing the \u003ccode\u003ealg_wc_ev_verify_email\u003c/code\u003e parameter targeting the WordPress home directory or specific verification endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T04:24:03Z","date_published":"2026-10-16T04:24:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-woocommerce-priv-esc/","summary":"The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthenticated privilege escalation due to insufficient entropy in activation token generation when configured to use the 'hashids' encoding method.","title":"CVE-2026-104745 - Privilege Escalation in Customer Email Verification for WooCommerce","url":"https://feed.craftedsignal.io/briefs/2026-10-woocommerce-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Customer Email Verification for WooCommerce (\u003c= 3.3.0)","version":"https://jsonfeed.org/version/1.1"}