Germanized for WooCommerce Private Data Exposure via Activation Token Reuse (CVE-2026-109231)

1. Vulnerability Overview & Root Cause

This vulnerability exists in the Germanized for WooCommerce plugin due to a logical flaw in the on_user_email_changed hook. This hook is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account. However, this hook is only registered inside the is_double_opt_in_login_enabled() branch when "Disable login for unactivated customers" is set to Yes. When this setting is configured to No, the original ?activate= token remains valid and entirely unbound to the email address it was originally issued for.

2. Exploitation Mechanics & Attack Scenario

An authenticated attacker with Subscriber-level access or above can exploit this vulnerability through the following steps:

• The attacker updates their account email to a victim's billing email address via the standard /my-account/edit-account/ form.
• Because the token rotation hook does not trigger, the attacker's original activation token remains valid.
• The attacker redeems their original activation token through customer_account_activate(), which triggers link_customer_past_orders().
• This function reassigns any matching guest orders associated with the victim's email to the attacker's account, exposing the victim's billing name, street address, phone number, and purchased items on the attacker's My Account page.

3. Infrastructure & Business Impact

Exploitation of this vulnerability leads to unauthorized access to Personally Identifiable Information (PII). This can result in severe compliance violations (such as GDPR), loss of customer trust, and potential legal liabilities for e-commerce merchants who process guest checkouts.