Zorem Customer Email Verification for WooCommerce Plugin authenticate_user_by_email_link improper authentication

Summaryinfo

A vulnerability marked as critical has been reported in Zorem Customer Email Verification for WooCommerce Plugin up to 2.8.2. The affected element is the function authenticate_user_by_email_link. The manipulation of the argument cusomer_email_verify leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-109236. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Zorem Customer Email Verification for WooCommerce Plugin up to 2.8.2. It has been rated as critical. This issue affects the function authenticate_user_by_email_link. The manipulation of the argument cusomer_email_verify with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.

The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2026-109236 since 10/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/28/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Zorem

Name

• Customer Email Verification for WooCommerce Plugin

Version

• 2.8.0
• 2.8.1
• 2.8.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion