CVE-2024-13528: high-severity vulnerability in wpcodefactory Customer Email Verification for…
Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.9.5. This is due to the presence of a shortcode that will generate a confirmation link with a placeholder email. This makes it possible for authenticated attackers, with Contributor-level access and above, to generate a verification link for any unverified user and log into the account. The 'Fine tune placement' option must be enabled in the plugin settings in order to exploit the vulnerability.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
wpcodefactory · Customer Email Verification for WooCommerceRelated CVEs — wpcodefactory Customer Email Verification for…
In the same product, most dangerous first.
CVE-2024-4185HIGHCustomer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient RandomnessEPSS 0.9%CVE-2026-104745HIGHCustomer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' ParameterEPSS 0.7%CVE-2024-13525MEDIUMCustomer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information ExposureEPSS 0.4%