CVE-2026-14182
Critical
Description
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCustomer Email Verification for WooCommerce
PublishedAug 13, 2026
First seenAug 13, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- Customer Email Verification for WooCommerce3.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Customer Email Verification for WooCommerce | 2.4.0 ≤ v < 3.2.6 | 3.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.