CVE-2026-14182

CRITICAL9.8

Published 2026-08-13 · Updated 2026-08-13 · Source contact@wpscan.com

Description

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-287

References

https://wpscan.com/vulnerability/ef4e95a3-6f90-4423-9551-9ac28f7b6291/

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-73533
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
2026-08-13 · score 9.8
CVE-2026-73532
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
2026-08-13 · score 9.8
CVE-2026-53791
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.
2026-08-13 · score 9.1
CVE-2026-66691
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
2026-08-13 · score 9.8
CVE-2026-66478
Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
2026-08-13 · score 9.3