CVE-2026-5722
Authentication Bypass in MoreConvert Pro WordPress Plugin
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moreconvert | moreconvert_pro | to 1.9.14 (inc) |
| moreconvert | moreconvert_wishlist | to 1.9.14 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The MoreConvert Pro plugin for WordPress has an authentication bypass vulnerability in all versions up to and including 1.9.14. This occurs because the guest waitlist verification process does not invalidate or regenerate verification tokens when a customer changes their email address. As a result, an unauthenticated attacker can obtain a valid guest verification token for an email they control, then change the guest customer email to the target user's email through the public waitlist flow, and finally use the original verification link to authenticate as that user, including administrators.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows unauthenticated attackers to bypass authentication and gain access to accounts, including those with administrative privileges. This can lead to unauthorized access to sensitive information, modification or deletion of data, and full control over the affected WordPress site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the MoreConvert Pro plugin allows unauthenticated attackers to bypass authentication and potentially access or impersonate existing users, including administrators. This unauthorized access to user accounts and potentially sensitive data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive information.
Specifically, the failure to invalidate or regenerate verification tokens when a customer email address is changed can result in unauthorized data exposure or manipulation, undermining confidentiality, integrity, and availability requirements mandated by these standards.
Therefore, organizations using affected versions of the plugin may face compliance risks if this vulnerability is exploited, emphasizing the importance of updating to the fixed version to maintain regulatory compliance.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in the MoreConvert Pro plugin for WordPress, you should immediately update the plugin to version 1.9.14 or later, as this version includes fixes that address the authentication bypass issue.
Ensure that your WordPress installation and all plugins are kept up to date to prevent exploitation of known vulnerabilities.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided in the available resources or CVE description about commands or methods to detect this vulnerability on your network or system.
Generally, detection of this vulnerability would involve checking the version of the MoreConvert Pro or Wishlist plugin installed on your WordPress site to see if it is at or below version 1.9.14, which is vulnerable.
You can check the plugin version via WordPress admin dashboard or by running commands on the server hosting WordPress, for example:
- Using WP-CLI to check plugin version: wp plugin list | grep moreconvert
- Manually inspecting the plugin's main file header for version information.
Since the vulnerability involves authentication bypass via token misuse in the guest waitlist verification flow, monitoring unusual authentication or token usage patterns in web server logs or application logs might help detect exploitation attempts, but no specific commands or signatures are provided.