Brute-Force Vulnerability in OTP Login & Register WooCommerce Plugin by WordPress
CVE-2026-110135
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 October 2026
Badges
What is CVE-2026-110135?
The OTP Login & Register WooCommerce plugin for WordPress, prior to version 2.7.3, is susceptible to a brute-force attack due to inadequate limitations on one-time-password verification attempts. This is a critical flaw as it allows an unauthenticated attacker to manipulate the attempt limit by supplying a value freely, enabling them to bypass safeguards. Consequently, attackers can perform repeated attempts to guess the short numeric login code, potentially taking over user accounts without needing the actual password.
Affected Version(s)
OTP Login & Register Woocommerce 0 < 2.7.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.