CVE-2026-104745: CWE-269 Improper Privilege Management in wpcodefactory Customer Email Verification for WooCommerce
Description
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.
CVSS v3.1
Score 8.1high
Affected software
wpcodefactory
Customer Email Verification for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104745 describes a privilege escalation vulnerability in the Customer Email Verification for WooCommerce plugin for WordPress versions up to 3.3.0. The vulnerability arises because the per-user activation secret is generated using wp_rand(100), resulting in only about 101 possible values when the 'Encoding method' is set to 'hashids'. The token is a reversible Hashids encoding without a cryptographic MAC, and the verification handler accepts the attacker-controlled 'alg_wc_ev_verify_email' GET parameter without nonce checks or rate limiting. An attacker who can brute-force the small token space and recover or guess the Hashids salt (defaulting to md5(time()) at initialization) can authenticate as any unverified WordPress user, including administrators.
Potential Impact
Successful exploitation allows unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts. This can lead to full system compromise, data exposure, and unauthorized administrative actions. The attack requires the plugin's encoding method to be set to 'hashids' and the target account's email to remain unverified.
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should verify the vendor advisory for updates. Until a fix is available, avoid setting the 'Encoding method' to 'hashids' and ensure all user emails are verified promptly. Monitor for plugin updates addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-10-02T12:04:27.373Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad1a22c2cdf04f656b2c8b0
Added to database: 10/16/2026, 04:03:56 UTC
Last enriched: 10/16/2026, 04:18:39 UTC
Last updated: 10/16/2026, 19:03:29 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.