Authentication Bypass in Naimur Email OTP Verification for WooCommerce Plugin by WordPress

CVE-2026-104014

What is CVE-2026-104014?

The Naimur Email OTP Verification for WooCommerce plugin for WordPress suffers from an authentication bypass vulnerability. This weakness allows unauthenticated attackers to take over user accounts by exploiting the password-reset mechanism. The flaw arises because the plugin verifies password resets based solely on a 'VERIFIED' status in the database, without session binding, timestamp checking, or a per-reset token. If an account owner exits the password reset process, the verification row remains intact, leaving it vulnerable. Furthermore, a missing cleanup function means those verification records linger indefinitely. Attackers only need a victim’s email address and a nonce that is readily available through the WooCommerce front end, enabling them to overwrite passwords and gain access, potentially leading to full site takeover if the compromised account has administrative privileges.

References