{"metadata": {"vulnerability": "CVE-2026-104745", "count": 16, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-02T12:04:27.373Z", "date_only": false, "value": "2026-10-02T12:04:27.373Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104745", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-02T12:19:20Z", "date_only": false, "value": "2026-10-02T12:19:20.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104745", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T15:31:05Z", "date_only": false, "value": "2026-10-15T15:31:05.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104745", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T03:38:41.491Z", "date_only": false, "value": "2026-10-16T03:38:41.491Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104745", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T03:38:41.491Z", "date_only": false, "value": "2026-10-16T03:38:41.491Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104745", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T03:51:59.267Z", "date_only": false, "value": "2026-10-16T03:51:59.267316Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448554498832281", "record": "CVE-2026-104745", "field": "creation_timestamp", "uuid": "dec1e88b-313e-4968-bafd-5c773feec0dd", "content": "CVE-2026-104745 Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler \u2014 hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting \u2014 accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104745https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=cvehttps://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/alg-wc-ev-functions.php#L331https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L784https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L498https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/3.3.0/includes/class-alg-wc-ev-core.php#L1258https://plugins.trac.wordpress.org/changeset?reponame=&old=3744623%40emails-verification-for-woocommerce&new=3744623%40emails-verification-for-woocommerce#wordpress #wpcodefactory #CustomerEmailVerificationforWooCommerce#CVE_2026_104745#bot", "url": "https://infosec.exchange/users/cve/statuses/117448554498832281"}, {"timestamp": "2026-10-16T04:18:21Z", "date_only": false, "value": "2026-10-16T04:18:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HRMJ-F3F9-PQ8R", "record": "GHSA-HRMJ-F3F9-PQ8R", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T04:18:21.607Z", "date_only": false, "value": "2026-10-16T04:18:21.607", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104745", "record": "FKIE_CVE-2026-104745", "field": "published"}, {"timestamp": "2026-10-16T06:30:23Z", "date_only": false, "value": "2026-10-16T06:30:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HRMJ-F3F9-PQ8R", "record": "GHSA-HRMJ-F3F9-PQ8R", "field": "published"}, {"timestamp": "2026-10-16T06:30:23Z", "date_only": false, "value": "2026-10-16T06:30:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HRMJ-F3F9-PQ8R", "record": "GHSA-HRMJ-F3F9-PQ8R", "field": "modified"}, {"timestamp": "2026-10-16T11:21:29.203Z", "date_only": false, "value": "2026-10-16T11:21:29.203497Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxyhit6r7j26", "record": "CVE-2026-104745", "field": "creation_timestamp", "uuid": "206920c5-4a27-4aa4-984a-190c70a6e6bc", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cCustomer Email Verification for WooCommerce\u300dv3.3.0\u4ee5\u524d\u3067\u3001\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u3002\u653b\u6483\u8005\u306f\u8a2d\u5b9a\u5909\u66f4\u3068\u30b3\u30fc\u30c9\u63a8\u6e2c\u3067\u3001\u672a\u691c\u8a3c\u30e6\u30fc\u2026\nCVE-2026-104745 CVSS 8.1 | HIGH", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mxyhit6r7j26"}, {"timestamp": "2026-10-16T14:50:43.348Z", "date_only": false, "value": "2026-10-16T14:50:43.348176Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104745", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:50:43.348Z", "date_only": false, "value": "2026-10-16T14:50:43.348176Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104745", "record": "FKIE_CVE-2026-104745", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:09:41.042Z", "date_only": false, "value": "2026-10-16T15:09:41.042Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104745", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:09:41.042Z", "date_only": false, "value": "2026-10-16T15:09:41.042Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104745", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:17:03.563Z", "date_only": false, "value": "2026-10-16T15:17:03.563", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104745", "record": "FKIE_CVE-2026-104745", "field": "lastModified"}]}