CVE-2026-5722 is an authentication bypass vulnerability in MoreConvert Pro for WordPress (versions up to 1.9.14). The vulnerability occurs because the guest waitlist verification flow fails to invalidate or regenerate verification tokens when the customer email address is changed. An attacker can obtain a valid guest verification token for an attacker-controlled email, then change the guest customer email to the target user's email via the public waitlist flow, and finally use the original verification link to authenticate as that user, including administrators. This allows unauthorized access without credentials.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain access to accounts of existing users, including administrators. This compromises confidentiality, integrity, and availability of the affected WordPress site and potentially allows full control over the site through administrative privileges.

Patch status is not yet confirmed — no official fix or patch is currently available. Users should monitor the vendor advisory for updates and apply any official patches once released. Until a fix is available, consider disabling the MoreConvert Pro plugin or restricting access to the waitlist functionality to trusted users only to reduce exposure.