EUVD-2026-63827
GHSA-rcq9-wgmf-73g5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, no auth or interaction, and low complexity since the token is simply read from the response; full account takeover of any user yields C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.
Articles & Coverage 2
AnalysisAI
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The plugin must be installed and active with its email-OTP / magic-login flow enabled and the handle_email_otp_return() endpoint publicly reachable (the default for this login feature), and the attacker must know the email address of the target account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an administrator's email address via the WordPress REST users endpoint or author archive pages, then sends a crafted OTP/magic-login request to the plugin's public endpoint for that email. Because the response includes the secret login token, the attacker reads it directly from the HTTP reply and replays it to authenticate as the administrator, gaining full site control. … |
| Remediation | No vendor-released patched version is identified in the available input, so a specific fix version cannot be cited - monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/7e473896-d94c-4f6a-a96c-bb90902532cc?source=cve) and the plugin's WordPress.org page for a release above 4.8.6 and upgrade as soon as it ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately audit your WordPress infrastructure to identify instances running versions 4.8.6 or earlier of this plugin and prioritize them for remediation within 24 hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today