The Customer Email Verification for WooCommerce plugin contains an authentication bypass vulnerability (CWE-287) due to a shortcode that generates confirmation links with placeholder emails. This allows authenticated attackers with Contributor-level privileges or above to create verification links for arbitrary unverified users and log into their accounts. Exploitation depends on the plugin's 'Fine tune placement' setting being enabled. The vulnerability affects all versions up to and including 2.9.5. No known exploits in the wild have been reported, and no patch or remediation details are provided in the available data.

Successful exploitation enables attackers with low-level authenticated access (Contributor or higher) to bypass authentication controls and access other users' accounts by generating verification links. This results in full compromise of confidentiality, integrity, and availability of affected user accounts within the WooCommerce environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the 'Fine tune placement' option in the plugin settings to prevent exploitation. Additionally, restrict Contributor-level access to trusted users only and monitor for suspicious account verification activities.