Authentication Bypass in OTP Login & Register Woocommerce Plugin for WordPress

CVE-2026-12215

What is CVE-2026-12215?

The OTP Login & Register Woocommerce plugin for WordPress is susceptible to a critical authentication bypass vulnerability. This arises from the way the OTP rate-limit attempt counter is managed, relying solely on an attacker-controlled cookie's IP address field. Attackers can exploit this by rotating the cookie, thereby resetting the counter without limit. The OTP generation mechanism uses PHP's rand() function, which limits the possible values significantly, allowing brute-force attempts with relative ease. Both the OTP request and verification endpoints are accessible without authentication, enabling unauthorized users to trigger OTP issuance by knowing the target user's registered phone number. Consequently, this opens the door for brute-force attacks, potentially granting access to any registered account, including those with administrative privileges.

References