Automation Web Platform Notifications And Otp For Woocommerce Advanced Country Code
Monthly
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.