Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

Overview

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the alg_wc_ev_verify_email parameter in versions up to, and including, 3.3.0. The vulnerability exists because alg_wc_ev_generate_user_code() generates the per-user activation secret using wp_rand(100) when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated verify() handler — hooked to init at PHP_INT_MAX with no nonce check and no rate limiting — accepts and acts on the attacker-controlled ?alg_wc_ev_verify_email= GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an md5(time()) value set at first initialization), and that the target account's email address remain unverified.

Affected

• customer_email_verification_for_woocommerce <= 3.3.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.