CVE-2026-109231

Name of the Vulnerable Software and Affected Versions Germanized for WooCommerce versions prior to 4.1.5

Description An issue exists where authenticated attackers with Subscriber-level access or higher can gain unauthorized access to private data. This occurs when the on user email changed hook fails to rotate the activation token if the setting Disable login for unactivated customers is set to No. An attacker can change their account email to a victim's billing email via the /my-account/edit-account/ endpoint and then use their original activation token through the customer account activate() function. This triggers the link customer past orders() function, which reassigns guest orders matching the email to the attacker's account, exposing the original buyer's billing name, street address, phone number, and purchased items. This requires double opt-in to be enabled, public customer registration to be active, and the token to be used within its one-day expiry window.

Recommendations Update Germanized for WooCommerce to version 4.1.5 or later. As a temporary mitigation, ensure the Disable login for unactivated customers setting is set to Yes.