Login Request a demo
High severity · published Apr 30, 2024
CVE-2024-4185
Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Customer Email Verification for WooCommerce · wpcodefactory
through 2.7.4 · source: vendor, CISA
Affected product
CE
Customer Email Verification for WooCommerce
wpcodefactory
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4185
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.7.4/includes/alg-wc-ev-functions.php#L299
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.7.4/includes/class-alg-wc-ev-core.php#L731
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3078804/emails-verification-for-woocommerce#file2
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ebae4b18-5b5f-45c3-86e2-02eefd7abdb7?source=cve
More from Customer Email Verification for WooCommerce
8.1
CVE-2026-104745
Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
7.5
CVE-2024-13528
Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode
6.5
CVE-2024-13525
Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure