PT-2026-36944 · WordPress · Moreconvert Pro

Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-5722

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MoreConvert Pro versions prior to 1.9.15

Description The MoreConvert Pro plugin for WordPress contains an authentication bypass flaw. The issue exists because the guest waitlist verification flow fails to invalidate or regenerate verification tokens when a customer email address is modified. An unauthenticated attacker can exploit this by obtaining a valid guest verification token for an email they control, changing that email to a target account email via the public waitlist flow, and then utilizing the original verification link to authenticate as the target user, including administrators.

Recommendations Update to a version later than 1.9.14.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-5722

Affected Products

Moreconvert Pro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-5722 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fe887475-f7e8-4fda-a793-bc6f37b70f3e?source=cve · Note
• https://moreconvert.com/changelog · Note
• https://wordpress.org/plugins/smart-wishlist-for-more-convert · Note
• https://twitter.com/OrizonCyber/status/2051489575239864503 · Twitter Post