AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2024-4185

HIGH · CVSS 8.1 EPSS 0.85%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2024-04-30 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.1. It affects WordPress. Exploitation may require the attacker to be authenticated.

CVE
CVE-2024-4185
Severity
HIGH
CVSS
8.1
EPSS
0.85%
WordPress

Original NVD Description

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.