EUVD-2026-75928
GHSA-26m4-chch-cqh3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-exploitable unauthenticated brute force; scope changes because admin session grants full WordPress/server access beyond the plugin.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
4DescriptionCVE.org
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in process_otp_form is keyed exclusively on the attacker-controlled xoo_ml_user_ip_data cookie's ip_address field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic rand() function over a default space of only 9,000 possible values (1000-9999), and both the OTP issuance endpoint (xoo_ml_login_with_otp) and verification endpoint (xoo_ml_otp_form_submit) are registered as unauthenticated wp_ajax_nopriv actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session - including for administrator accounts - via wp_set_auth_cookie() in login_user_with_otp(). Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated xoo_ml_login_with_otp endpoint.
AnalysisAI
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled xoo_ml_user_ip_data cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic rand() over only 9,000 possible values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires prior knowledge of the target user's phone number as registered in the WordPress/WooCommerce installation - this is the sole real-world barrier and is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` AJAX endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS base score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) critically understates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A patch has been committed to the plugin's trunk branch (WordPress plugin repository changeset 3639216 modifying `class-xoo-ml-otp-handler.php`), but the exact released version number containing this fix is not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Brute Force
View allRuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address fi
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits o
Critical authentication bypass vulnerability in OpenC3 COSMOS v6.0.0 caused by weak password requirements that enable br
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immedia
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creatio
Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. Rated critical severity (CVSS 9.8), this
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. Rated critical severity (CVSS 9.8)
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. R
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2. Rated critical severity (CVSS 9.8), this
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today