The Customer Email Verification for WooCommerce plugin before version 3.2.6 contains an improper authentication vulnerability (CWE-287) caused by incorrect validation of the email-verification activation code. The plugin uses a loose comparison that can be satisfied by a crafted value type, allowing an attacker without authentication to verify and assume control of any account with an unconfirmed email address. This issue affects version 2.4.0 as explicitly stated. There is no CVSS score or vendor advisory indicating a patch or remediation status.

An attacker can bypass the intended email verification process and take over accounts of users who have not confirmed their email addresses. This compromises account integrity and potentially allows unauthorized access to user data or actions within the WooCommerce environment. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to unverified accounts to mitigate risk. Monitor vendor channels for updates or patches addressing this vulnerability.