Releasit Cod Form Upsells
Monthly
OTP validation bypass in Releasit COD Form & Upsells v1 allows unauthenticated remote attackers to circumvent the Cash-on-Delivery phone verification step by manipulating client-side enforcement logic instead of relying on a server-side check. Affected Shopify merchants running v1 are exposed to fraudulent order placement without valid OTP confirmation. A public proof-of-concept exploit has been published on GitHub; no CISA KEV listing exists at time of analysis.
OTP validation bypass in Releasit COD Form & Upsells v1 allows unauthenticated remote attackers to circumvent the Cash-on-Delivery phone verification step by manipulating client-side enforcement logic instead of relying on a server-side check. Affected Shopify merchants running v1 are exposed to fraudulent order placement without valid OTP confirmation. A public proof-of-concept exploit has been published on GitHub; no CISA KEV listing exists at time of analysis.