OTP Login Woocommerce EUVD-2026-102696

Requires the target WordPress site to have the 'OTP Login & Register Woocommerce' plugin at a version before 2.7.3 installed and with its OTP-based login/registration flow enabled and reachable; the attacker needs only to trigger an OTP for a target account, then replay verification requests while altering the client-supplied value the plugin trusts to count attempts. No authentication (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the plugin and its OTP login mode must actually be in use, the attacker must know/enumerate a valid target account identifier (phone/email), and despite the broken counter the numeric code must still be brute-forced over many requests (reflected in CVSS AC:H), which network-level rate limiting or a WAF could blunt.

Signals are mostly consistent but point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N, base 7.4 HIGH) describes an unauthenticated, network-reachable flaw yielding full account takeover, with AC:H reflecting that brute-forcing a numeric OTP still requires many attempts even after the broken counter is bypassed. Against that, exploitation-likelihood signals are low: EPSS is 0.15% (4th percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active, widespread exploitation. However, publicly available exploit code exists (WPScan), which raises the practical likelihood above what EPSS alone suggests and lowers the skill barrier. No SSVC decision record was provided in the input, so exploitation-status/automatable/technical-impact cannot be read from a formal SSVC tree - the automatability is inferred (the brute-force is scriptable) rather than vendor-stated. Net: a genuine account-takeover bug worth prompt patching for any site running the plugin, but the low EPSS, absence of KEV, and AC:H argue against treating it as a drive-everything emergency. Conflict to note: POC exists yet EPSS remains very low - exploit code availability and real-world exploitation volume are distinct, and this gap suggests opportunistic/targeted use rather than mass exploitation at time of analysis.

An unauthenticated attacker targets a WordPress/WooCommerce site using this plugin's OTP login, requests a one-time code for a victim's phone/email, then scripts repeated verification guesses while manipulating the client-supplied value the plugin uses to count attempts, resetting it to evade the lockout. Because the code is short and numeric, the attacker brute-forces it and logs in as the victim with no password. A public exploit (WPScan) is available, reducing the effort required to reproduce this.