The MoreConvert Pro WordPress plugin up to version 1.9.14 contains an authentication bypass vulnerability. This flaw arises because the guest waitlist verification tokens are not invalidated or regenerated when the associated customer email address is changed. An unauthenticated attacker can exploit this by obtaining a valid guest verification token for an attacker-controlled email, then changing the guest email to a target user's email, allowing the attacker to authenticate as that user, including administrators.