CVE-2026-14182
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Customer Email Verification for WooCommerce WordPress plugin before version 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
Risk Assessment
An attacker can take over accounts of users who have not confirmed their email address, potentially leading to data theft, fraud, or unauthorized actions on their behalf.
Recommendation
Update the Customer Email Verification for WooCommerce plugin to version 3.2.6 or later, which includes the fix. Consider enforcing email verification for all accounts.
Original NVD description (English source)
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.