---
id: CVE-2026-104745
title: >-
  The Customer Email Verification for WooCommerce plugin for WordPress is
  vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter
  in versions up to, and including, 3.3.0
summary: >-
  The Customer Email Verification for WooCommerce plugin for WordPress is
  vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter
  in versions up to, and including, 3.3.0. The vulnerability exists because
  `alg_wc_ev_ge…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
vendor: wpcodefactory
product: Customer Email Verification for WooCommerce
affected:
  - customer_email_verification_for_woocommerce <= 3.3.0
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:17:03.563'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104745'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00684
epssPercentile: 0.52374
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/rxsklife/CVE-2026-104745'
  checkedAt: '2026-10-27T18:52:45.380Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T14:50:43.348176Z'
ingestedAt: '2026-10-16T03:57:49.270Z'
---

## Overview

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.