Threats tagged 'ghsa-fmvc-698m-vpm5'

The Customer Email Verification plugin for WooCommerce on WordPress has an authentication bypass vulnerability in all versions up to 2.8.2. The flaw arises from a predictable email verification token and lack of proper capability or nonce checks in the authentication function. This allows unauthenticated attackers to log in as verified customers or mark existing accounts as verified, bypassing email verification controls. Exploitation depends on the presence of a password column in a specific database table, which exists only on upgraded sites from older versions.