CVE-2026-109231
Received Received - Intake

Unauthorized Data Access in Germanized for WooCommerce

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when "Disable login for unactivated customers" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have double opt-in enabled with "Disable login for unactivated customers" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-109231
EUVD
EUVD-2026-114696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vendidero Germanized for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-841 The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Germanized for WooCommerce plugin for WordPress has a flaw where an attacker with Subscriber-level access or higher can change their account email to a victim's billing email. If the site has double opt-in enabled and 'Disable login for unactivated customers' set to No, the attacker can reuse an old activation token to link the victim's past orders to their own account. This exposes the victim's billing details and purchased items.

Detection Guidance

Check WordPress sites using Germanized for WooCommerce versions up to 4.1.4. Review user accounts for unexpected email changes or order reassignments. Inspect activation tokens and account activation settings in WooCommerce configuration.

Impact Analysis

If you are a WordPress site owner using the Germanized for WooCommerce plugin up to version 4.1.4, an attacker could access private customer data like billing names, addresses, phone numbers, and order details. Customers may have their personal information exposed if the site meets the specific vulnerable configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles. If customer data is exposed, it may result in non-compliance with GDPR's requirements for data security and user consent. HIPAA-covered entities could face similar issues if protected health information is exposed.

Mitigation Strategies

Update Germanized for WooCommerce to the latest version. Enable 'Disable login for unactivated customers' in WooCommerce settings. Disable public customer registration if not needed. Monitor user accounts for suspicious email changes or order reassignments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart