MoreConvert Pro WordPress Plugin Critical Authentication Bypass (CVE-2026-5722)

The MoreConvert Pro plugin for WordPress is exposed to a critical authentication bypass vulnerability, identified as CVE-2026-5722. According to the National Vulnerability Database, all versions up to and including 1.9.14 are affected. This flaw stems from an oversight in the guest waitlist verification process, where verification tokens are not properly invalidated or regenerated when a customer’s email address is changed.

This design flaw creates a dangerous window for unauthenticated attackers. They can obtain a valid guest verification token for an email they control, then manipulate the public waitlist flow to change that same guest customer email to a target account’s email address. Crucially, they can then leverage the original verification link to authenticate as the target user, including high-privilege administrators.

With a CVSS score of 9.8 (Critical), this vulnerability represents a severe risk. It effectively allows full account takeover without requiring any prior authentication, making it a prime target for attackers looking to gain deep access to WordPress sites. The attacker’s calculus here is straightforward: exploit a broken authentication mechanism to gain control, then pivot to broader compromise.