Introduction
A critical authentication bypass in the MoreConvert Pro plugin for WordPress lets unauthenticated attackers log in as any existing user, including site administrators. The attack exploits a token reuse flaw in the guest waitlist verification flow. The vulnerability has a CVSS score of 9.8 and requires no authentication, so it puts WooCommerce stores that rely on the plugin for marketing and conversion features at direct risk.
MoreConvert Pro is a WooCommerce marketing plugin developed by the Moreconvert Team. It offers features like back-in-stock notifications, wishlists, and advanced analytics. The free version of the plugin has over 9,000 active installations on the WordPress Plugin Repository. The premium Pro version adds more functionality, including the waitlist flow where this vulnerability resides. The plugin participates in the Patchstack Vulnerability Disclosure Program for security bug triage.
Technical information
The vulnerability is classified under CWE-287 (Improper Authentication) and resides in the guest waitlist verification flow of the MoreConvert Pro plugin.
Root cause
When a guest user signs up for a product waitlist, the plugin generates a verification token tied to the guest's email address. If the customer email address on a guest record is later changed through the public waitlist flow, the plugin does not invalidate or regenerate the token it already issued. The old token remains valid and becomes implicitly bound to the new email address.
Attack flow
The exploit is straightforward and requires no prior authentication:
- The attacker registers as a guest on the waitlist with an email address they control, and the plugin issues a verification token for that email.
- The attacker uses the publicly accessible waitlist flow to change the guest customer email from their own address to the email address of a target account, such as a site administrator.
- The attacker opens the original verification link, which still contains the token issued in step 1.
- Because the token was never invalidated when the email changed, the system treats the verification as legitimate and authenticates the attacker as the target user.
The only prerequisite is knowing the target account's email address. In WooCommerce environments, administrator email addresses are frequently discoverable through author archives, public contact pages, or other common information disclosure vectors.
A successful exploit gives the attacker full access to the target account. If the target is an administrator, the attacker gets complete control over the WordPress installation and can modify site content, install plugins, access customer data, and manipulate WooCommerce orders and payment configurations.
Severity context
The CVSS 9.8 score comes from a combination of factors: the attack works over the network, has low complexity, needs no privileges or user interaction, and can lead to complete compromise of confidentiality, integrity, and availability.
Affected systems and versions
The vulnerability affects the MoreConvert Pro plugin for WordPress in all versions up to and including 1.9.14.
Wordfence recommends updating to version 1.9.15 or later as the remediation baseline. The vendor's own changelog references 1.9.14 as a fixed version, which conflicts with the Wordfence advisory: Wordfence explicitly states that 1.9.14 is vulnerable. Administrators should follow the Wordfence guidance and make sure they are running 1.9.15 or newer.
| Source | Stated fixed version | Guidance |
|---|---|---|
| Wordfence Vulnerability Database | 1.9.15 | Use as the authoritative remediation baseline |
| WordPress Plugin Repository | 1.9.15 | Confirms the fix is included in the 1.9.15 release cycle |
| MoreConvert Vendor Changelog | 1.9.14 | Conflicts with Wordfence. Do not rely on this as the patched version |
The free version of the plugin (MoreConvert Wishlist for WooCommerce) is listed separately on the WordPress Plugin Repository, but the vulnerable waitlist verification flow exists only in the premium Pro version.
Vendor security history
The Moreconvert Team uses the Patchstack Vulnerability Disclosure Program to handle and triage security bugs, which indicates a structured approach to vulnerability management. The available source materials reference no prior CVEs for this vendor.
