Customer Email Verification for WooCommerce (<= 3.3.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/customer-email-verification-for-woocommerce--3.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 04:24:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-104745 - Privilege Escalation in Customer Email Verification for WooCommercehttps://feed.craftedsignal.io/briefs/2026-10-woocommerce-priv-esc/Fri, 16 Oct 2026 04:24:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-woocommerce-priv-esc/The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthenticated privilege escalation due to insufficient entropy in activation token generation when configured to use the 'hashids' encoding method.The Customer Email Verification for WooCommerce plugin for WordPress, in versions up to and including 3.3.0, contains a critical security flaw that allows for unauthenticated privilege escalation. When the plugin is configured with the 'hashids' encoding method, it generates per-user activation secrets using the wp_rand(100) function. This results in an extremely low entropy of approximately 101 possible values, or 7 bits. Because these tokens are generated via reversible Hashids encoding without a cryptographic MAC, and because the verification handler hooked to the WordPress init action lacks nonce verification or rate limiting, an attacker can brute-force the activation code space. By supplying a forged alg_wc_ev_verify_email GET parameter, an unauthenticated attacker can verify and hijack unverified accounts, including those with administrative privileges, provided the attacker can recover or guess the Hashids salt, which typically defaults to an md5(time()) value generated at initial setup.

Impact

Successful exploitation allows an unauthenticated attacker to hijack any unverified WordPress account, including administrator accounts. This leads to full administrative control over the WordPress instance, enabling arbitrary code execution, data exfiltration, and full site compromise. This vulnerability impacts all WordPress environments utilizing the specified plugin version with the non-default 'hashids' configuration enabled.

Recommendation

  • Update the 'Customer Email Verification for WooCommerce' plugin to the latest version patched against CVE-2026-104745.
  • If patching is not immediately feasible, change the plugin's 'Encoding method' from 'hashids' to a more secure alternative or disable the plugin entirely.
  • Audit the WordPress user database for unverified accounts that could be targeted for hijacking.
  • Monitor web server logs for high-frequency GET requests containing the alg_wc_ev_verify_email parameter targeting the WordPress home directory or specific verification endpoints.
]]>highadvisoryweb-applicationwordpressprivilege-escalationcve-2026-104745