MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse
Strategic Overview
- Status
- Patched in 1.9.15
- Affected Plugin
- MoreConvert Pro
- Affected Version
<= 1.9.14- CVSS
- 9.8Critical
- Weakness type
- CWE-287 · Improper Authentication
- CVE
CVE-2026-5722
At a glance
CVE-2026-5722 is a critical-severity Improper Authentication vulnerability in the MoreConvert Pro WordPress plugin, affecting versions <= 1.9.14. It carries a CVSS score of 9.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 1.9.15; sites on affected versions should update now. Disclosed May 2026, reported by Nguyen Ngoc Duc (duc193).
Vulnerability Overview
The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.9.14. This is due to the guest waitlist verification flow not invalidating or regenerating verification tokens when the customer email address is changed. This makes it possible for unauthenticated attackers to authenticate as existing users, including administrators, by obtaining a valid guest verification token for an attacker-controlled email, changing the same guest customer email to the target account email through the public waitlist flow, and then using the original verification link.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-287: Improper Authentication
Reaching this weakness in MoreConvert Pro <= 1.9.14 takes a caller who can reach the endpoint. Improper authentication means the mechanism that proves who a caller is can be satisfied without the secret it was supposed to require.
An attacker authenticates as another user — administrators included — without ever knowing a password, so password policies and login rate limits never come into play. For MoreConvert Pro the fix is 1.9.15: builds <= 1.9.14 are affected, anything from 1.9.15 onward is not.
Remediation
Update to version 1.9.15, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: MoreConvert Pro 1.9.15 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C