Otp Login Register Woocommerce
Monthly
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.