CVE Intelligence
Analysis AI-assisted

CVE-2026-5722: MoreConvert Pro for WordPress: Authentication Bypass via Guest Verification Token

CVE-2026-5722 affects the MoreConvert Pro plugin for WordPress in all versions up to and including 1.9.14. The guest waitlist verification flow does not invalidate or regenerate tokens when the customer email changes, which the CNA describes as enabling unauthenticated authentication as existing users, including administrators. No confirmed exploitation appears in the sources consulted, and no fixed version is stated in the available record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The MoreConvert Pro plugin for WordPress is affected by an authentication bypass tracked as CVE-2026-5722 and classified as CWE-287 (Improper Authentication). According to the CNA description, the guest waitlist verification flow does not invalidate or regenerate verification tokens when the customer email address is changed. The record was published on 2026-05-05 by Wordfence and its status is listed as Deferred.

Impact

The CNA description states that an unauthenticated attacker could authenticate as existing users, including administrators. Wordfence assigned a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to network reachability, no privileges or user interaction required, and high impact on confidentiality, integrity and availability. Because administrator accounts may be reachable, the practical consequence for a site could include full control of content, users and plugin settings.

Affected products and versions

  • Product: MoreConvert Pro plugin for WordPress
  • Affected versions: all versions up to and including 1.9.14, according to the CNA description
  • Fixed version: not stated in the available record. Check the MoreConvert changelog and the WordPress.org plugin page for release information.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS values in the record (probability 0.00826, percentile 0.56311) are modeled estimates of exploitation likelihood, not observations of attacks.

Remediation and mitigation

  • Identify whether the MoreConvert Pro plugin is installed and which version is active.
  • Check the changelog for a release later than 1.9.14 that addresses this issue, and update as soon as a fixed version is confirmed.
  • If no fixed version is available, consider temporarily disabling the guest waitlist feature or restricting access to it, following guidance from the vendor.
  • Review administrator and high-privilege accounts for unexpected logins, password changes or email changes, and rotate credentials if anything looks unusual.
  • Treat outstanding verification links as sensitive and invalidate them where your site allows it.

Detection guidance

  • Review web server and application logs for requests to the waitlist or verification endpoints, especially repeated requests from the same source.
  • Look for customer records whose email address changed shortly before a verification link was used.
  • Audit recent logins to administrator accounts, focusing on unfamiliar IP addresses, new devices or logins that follow account email changes.

Limitations of the available information

The record does not list affected or fixed versions in structured fields, so the 1.9.14 boundary comes from the CNA description alone. No vendor advisory text beyond the plugin changelog and Wordfence reference was available, and the record title was empty. The EPSS date in the record is later than the publication date, so it should be interpreted with caution. Whether a particular site is exposed depends on whether the plugin and its waitlist feature are in use.

Frequently asked questions

Which versions of MoreConvert Pro are affected by CVE-2026-5722?

According to the CNA description, all versions up to and including 1.9.14 are affected. The structured affected-version list in the record is empty, so confirm against the vendor changelog.

Is this vulnerability being actively exploited?

The record does not list CVE-2026-5722 in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should site owners do now?

Check whether the plugin is installed, look for a release later than 1.9.14 in the changelog, and consider disabling the guest waitlist feature if no fix is available. Review administrator accounts for unexpected activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.