CVE-2026-14182 — Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authenticati…

CVE-2026-14182

Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass PUBLISHED

Description (CNA)

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

Affected (CNA)

Vendor / product	Versions
Unknown / Customer Email Verification for WooCommerce	affected 2.4.0 before 3.2.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ef4e95a3-6f90-4423-9551-9ac28f7b6291/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.