CVE-2026-5722: MoreConvert Pro WordPress Plugin Authentication Bypass (CVSS 9.8)

Executive Summary

A critical authentication bypass vulnerability (CVE-2026-5722) has been disclosed in the MoreConvert Pro plugin for WordPress, affecting all versions up to and including 1.9.14. The flaw carries a CVSS score of 9.8 — indicating maximum severity for a network-exploitable, unauthenticated attack path.

The vulnerability exists in the plugin's guest waitlist verification flow. When a customer's email address is changed, the system fails to invalidate or regenerate the associated verification token. An attacker can reuse a previously issued token alongside a substituted email address to authenticate as an arbitrary registered user without possessing their password.

Site owners running any affected version should apply the vendor patch immediately or disable the MoreConvert Pro waitlist feature until the update is applied.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The MoreConvert Pro plugin provides e-commerce conversion tools for WooCommerce-powered WordPress stores, including a guest waitlist feature that notifies customers when out-of-stock products become available. As part of this flow, the plugin issues verification tokens to guests to confirm their identity before performing waitlist-related operations.

The critical flaw: when a customer's email address is updated, the plugin does not invalidate or regenerate the verification token bound to the previous address. The old token remains valid and is not tied to a confirmed email.

An attacker can therefore:

1. Obtain a valid verification token (e.g., issued to their own guest session or observed in a URL)
2. Submit that token in a verification request along with a different user's email address
3. The plugin validates the token as legitimate (it was legitimately issued), then authenticates the request against the supplied email — granting access to that account

Attack Flow

1. Attacker triggers a guest waitlist signup and receives a verification token via email
2. Target user (with an existing account) changes their email address
3. Old token remains valid — it was not regenerated or revoked
4. Attacker constructs a crafted POST request:
   - verification_token: [attacker's still-valid token]
   - email: [target user's original or new email]
5. Plugin validates token signature — token is valid
6. Plugin looks up user by email — returns target account
7. Plugin authenticates the session as the target user
8. Attacker is now logged in without knowing the target's password

Exploitation Conditions

• MoreConvert Pro version 1.9.14 or earlier must be installed and active
• The waitlist/backorder notification feature must be enabled (common in WooCommerce stores)
• The attacker needs a valid unexpired verification token (obtainable via their own guest signup)
• The attacker needs a registered email address on the site (discoverable via product review authors, WooCommerce checkout exposure, or past data leaks)

Impact Assessment

Immediate Remediation

Step 1: Update MoreConvert Pro

Update the plugin to the latest version through the WordPress admin panel:

Plugins > Installed Plugins > MoreConvert Pro > Update Now

Or via WP-CLI:

wp plugin update moreconvert-pro
 
# Verify version after update
wp plugin get moreconvert-pro --field=version

Step 2: Disable Waitlist Feature if Update Is Delayed

If an immediate update is not possible, disable the guest waitlist / backorder notification functionality in MoreConvert Pro settings to remove the vulnerable code path.

Step 3: Audit for Compromise

# Check for recently created or modified administrator accounts
wp user list --role=administrator --fields=user_login,user_email,user_registered
 
# Look for accounts with recent login from unexpected IPs (requires audit log plugin)
# Check recent order changes or profile edits across all roles
wp db query "SELECT user_login, user_email, user_registered FROM wp_users WHERE user_registered > DATE_SUB(NOW(), INTERVAL 14 DAY);"
 
# Search for suspicious active sessions
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key = 'session_tokens';" | grep -v "^$"

Step 4: Harden Post-Update

# Invalidate all existing user sessions to force re-authentication
wp db query "DELETE FROM wp_usermeta WHERE meta_key = 'session_tokens';"
 
# Regenerate WordPress secret keys
wp config shuffle-salts
 
# Verify plugin integrity
wp plugin verify-checksums moreconvert-pro

Detection Indicators

Post-Remediation Checklist

1. Update MoreConvert Pro to the latest patched version
2. Disable the waitlist feature if the patch cannot be applied immediately
3. Invalidate all active user sessions to evict any attacker sessions
4. Audit administrator accounts — remove any unrecognized entries
5. Review access logs for suspicious login patterns over the past 30 days
6. Reset passwords for any accounts showing anomalous login activity
7. Regenerate WordPress secret keys to invalidate all existing auth cookies
8. Enable two-factor authentication for administrator and editor accounts
9. Deploy a Web Application Firewall with WordPress rule sets (Wordfence, Cloudflare)
10. Monitor for continued exploitation and alert on token-reuse request patterns

References

• NVD — CVE-2026-5722
• WordPress Plugin Repository — MoreConvert Pro
• Wordfence Vulnerability Database