Authentication Bypass Vulnerability in Happy Coders OTP Login Plugin for WooCommerce
CVE-2026-12492
Currently unrated
What is CVE-2026-12492?
The Happy Coders OTP Login for WooCommerce plugin prior to version 2.8 suffers from an authentication bypass issue. This flaw allows attackers to bypass the one-time password validation mechanism, enabling them to log in as any user, including administrative accounts. Furthermore, this vulnerability permits unauthorized users to create new accounts without validation, posing significant risks to the integrity and security of the affected WooCommerce installations.
Affected Version(s)
Happy Coders OTP Login for WooCommerce 1.5 < 2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.