Paper/Archive/CVE-2026-14182

CVE-2026-14182

Unknown Customer Email Verification for WooCommerce — Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 42.7.427 × 208.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

Affected

ProductAffectedFixed inSource

Customer Email Verification for WooCommerce2.4.0 – < 3.2.63.2.6CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/ef4e95a3-6f90-4423-9551-9ac28f7b6291