Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change

Summary

CVE	CVE-2026-109231
State	PUBLISHED
Assigner	Wordfence
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-10-31 10:16:37 UTC
Updated	2026-11-03 19:17:47 UTC
Description	The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when "Disable login for unactivated customers" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have double opt-in enabled with "Disable login for unactivated customers" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window.

Risk And Classification

Primary CVSS: v3.1 4.3 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.003690000 probability, percentile 0.309160000 (date 2026-11-03)

Problem Types: CWE-841 | CWE-841 CWE-841 Improper Enforcement of Behavioral Workflow

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	4.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`
3.1	CNA	DECLARED	4.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Vendidero	Germanized For WooCommerce	affected 4.1.4 semver	Not specified

References

Reference	Source	Link	Tags
plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-g...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/changeset	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-g...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-g...	[email protected]	plugins.trac.wordpress.org
www.wordfence.com/threat-intel/vulnerabilities/id/b661e8d7-c50e-4cbf-86a8-3e44d...	[email protected]	www.wordfence.com
plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-g...	[email protected]	plugins.trac.wordpress.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Sawyer (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-10-12T14:14:46.000Z	Vendor Notified
CNA	2026-10-30T21:04:17.000Z	Disclosed

There are currently no legacy QID mappings associated with this CVE.