CVE-2026-12215
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The OTP rate-limit attempt counter in process_otp_form is keyed exclusively on the attacker-controlled xoo_ml_user_ip_data cookie's ip_address field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic rand() function over a default space of only 9,000 possible values.
Risk Assessment
An unauthenticated attacker can brute-force the OTP for any registered account and obtain a full WordPress authentication session, including for administrator accounts, leading to full site takeover.
Recommendation
Update the OTP Login & Register Woocommerce plugin to a version newer than 2.7.2 as soon as a fix is available, and consider disabling OTP login until updated.
Related vulnerabilities
- CVE-2026-123966Critical
A vulnerability was found in Tenda AC19 version 16.03.10.07 in the saveParentControlInfo function of the /goform/saveParentControlInfo file. Manipulating the deviceId argument causes a heap-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-120984Critical
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can bypass security controls and upload a malicious JavaScript policy that executes on the server.
- CVE-2026-122041Critical
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress up to and including 3.8.0 is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function. The handler is registered for both wp_ajax and wp_ajax_nopriv and gated solely by the 'file_handling_nonce' nonce, which is exposed in the public checkout page markup.
- CVE-2026-119075Critical
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in FormHandler::validate_checkout_fields() in versions up to and including 1.1.4. The checkout registration path stores the raw $_POST['user_roles'] value without validation, and add_user_data() injects it as the new account's role.
- CVE-2026-118066Critical
The LatePoint plugin for WordPress is vulnerable to authentication bypass via account takeover in versions up to and including 5.7.6. OsModel::build_conditions_query() compares WHERE-clause values against literal strings 'IS NULL' and 'IS NOT NULL' and concatenates a match directly into SQL without binding, allowing unauthenticated attackers to send params[password_reset_token]=IS NOT NULL to the public customer_cabinet__change_password AJAX route and overwrite the lowest-id customer's password.
- CVE-2026-104014Critical
The Naimur Email OTP Verification for WooCommerce plugin is vulnerable to authentication bypass in versions up to and including 2.1.0. The password-reset finalization endpoint authorizes the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, session binding, or per-reset token, and the scheduled cleanup cron has no handler so it never runs.
- CVE-2026-123961Critical
A vulnerability was detected in TOTOLINK CA300-PoE version 6.2c.884 affecting the setWiFiBasicConfig function in /cgi-bin/cstecgi.cgi. Manipulation of the KeyStr argument leads to a buffer overflow. The attack can be initiated remotely and a public exploit is available.
- CVE-2026-123960Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setWanConfig function in /cgi-bin/cstecgi.cgi improperly handles the pppoeUser/priDns/secDns arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.
- CVE-2026-123959Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setLanguageCfg function in /cgi-bin/cstecgi.cgi improperly processes the langType argument, resulting in a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly released.
- CVE-2026-123958Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setLanConfig function in /cgi-bin/cstecgi.cgi mishandles the lanDns/lanSecDns/langType arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.
Original NVD description (English source)
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS