Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-14182— Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

Quick assessment

Affected
Unknown Customer Email Verification for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress Customer Email Verification for WooCommerce是WordPress基金会开源的一款验证客户电子邮箱的插件。 WordPress Customer Email Verification for WooCommerce 3.2.6之前版本存在授权问题漏洞，该漏洞源于未正确验证邮箱验证激活码，依赖宽松比较，攻击者可通过构造的值类型满足验证，导致未经身份验证的用户能够验证并接管任意未确认邮箱的注册用户账户。

AI Predicted 9.8 Difficulty: Easy EPSS 0.50% · P41

Possible ATT&CK Techniques 1 AI

T1110 · Brute Force

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Customer Email Verification for WooCommerce 2.4.0< 3.2.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14182

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Customer Email Verification for WooCommerce 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Customer Email Verification for WooCommerce是WordPress基金会开源的一款验证客户电子邮箱的插件。 WordPress Customer Email Verification for WooCommerce 3.2.6之前版本存在授权问题漏洞，该漏洞源于未正确验证邮箱验证激活码，依赖宽松比较，攻击者可通过构造的值类型满足验证，导致未经身份验证的用户能够验证并接管任意未确认邮箱的注册用户账户。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Customer Email Verification for WooCommerce 2.4.0 ~ 3.2.6 -

II. Public POCs for CVE-2026-14182

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14182

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-14182 (1)

Same Patch Batch · Unknown · 2026-08-13 · 8 CVEs total

CVE-2026-15413 10.0 CRITICAL Link Factory - Backdoor
CVE-2026-14332 5.4 MEDIUM Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via
CVE-2026-14213 Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR
CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
CVE-2026-13610 KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation v
CVE-2026-19088 ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

IV. Related Vulnerabilities

Same product: Customer Email Verification for WooCommerce
Same vendor: Unknown

V. Comments for CVE-2026-14182

No comments yet

Leave a comment