What is the CVSS score of CVE-2026-12492?

CVE-2026-12492 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of OTP Login for WooCommerce are affected by CVE-2026-12492?

The Happy Coders OTP Login for WooCommerce plugin (versions 1.5-2.7) contains a critical authentication bypass vulnerability affecting all WordPress sites using this plugin.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12492?

Yes, a public proof-of-concept exploit is available for CVE-2026-12492. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12492?

Within 24 hours, identify all WordPress installations using Happy Coders OTP Login for WooCommerce versions 1.5 through 2.7 and restrict WordPress admin access to trusted IP ranges; prepare a patching plan. Within 7 days, upgrade all affected instances to version 2.8 or later, verify plugin functionality post-upgrade, and monitor for unauthorized account creation. Within 30 days, conduct a security audit of affected WordPress sites to identify any unauthorized administrative accounts created during the vulnerability window and review authentication logs for suspicious patterns.

OTP Login for WooCommerce CVE-2026-12492

EUVD-2026-44873 CRITICAL

Improper Authentication (CWE-287)

2026-07-16 WPScan

GHSA-33cg-9r8g-hqm4

WordPress Authentication Bypass Happy Coders Otp Login For Woocommerce Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity bypass yields full admin takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged as impact stays within the WordPress application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 16:24 vuln.today

CVSS changed

Jul 16, 2026 - 16:22 NVD

9.8 (CRITICAL)

Patch available

Jul 16, 2026 - 10:18 EUVD

CVE Published

Jul 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 16, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.

Articles & Coverage 1

News Critical Authentication Bypass in WordPress Happy Coders OTP Login Plugin - CVE-2026-12492 Jul 16, 2026

AnalysisAI

Authentication bypass in the Happy Coders OTP Login for WooCommerce WordPress plugin (versions 1.5 through 2.7) lets unauthenticated remote attackers log in as any existing user, including administrators, and create arbitrary accounts. The plugin authenticates a user from a supplied identifier without confirming that the one-time password was ever validated. Publicly available exploit code exists (WPScan) and a vendor patch (2.8) is available; EPSS remains low at 0.15% despite the maximal 9.8 CVSS score.

Technical ContextAI

The plugin adds passwordless/OTP login to WooCommerce-backed WordPress sites, where a user requests a one-time code tied to a phone number or email identifier and submits it to authenticate. The root cause is CWE-287 (Improper Authentication): the login handler trusts the supplied identifier and issues a session for the matching account without enforcing that the corresponding OTP verification step actually succeeded. This severs the binding between 'proof of possession of the OTP' and 'authentication decision,' collapsing the second factor into a mere account-selection parameter. The affected component is cpe:2.3:a:unknown:happy_coders_otp_login_for_woocommerce, a third-party WooCommerce extension rather than WordPress core.

RemediationAI

Vendor-released patch: version 2.8. Upgrade the Happy Coders OTP Login for WooCommerce plugin to 2.8 or later immediately; this is the primary and complete fix. If an upgrade cannot be applied at once, deactivate and remove the plugin entirely, since the authentication bypass is inherent to its login flow - the trade-off is that legitimate OTP/passwordless login is disabled until the plugin is restored, so users must fall back to standard WordPress credentials. As compensating controls pending patching, restrict access to the plugin's OTP login endpoints via WAF rules or web-server access controls, and audit user accounts for unexpected new registrations or administrator logins that may indicate prior exploitation, forcing password resets on privileged accounts. Consult the WPScan advisory (https://wpscan.com/vulnerability/56fdcba6-c7b1-443d-9f9d-b738ecaadabc/) for exploit specifics before exposing the endpoint again.