CVE-2026-12492
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Happy Coders OTP Login for WooCommerce plugin before version 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier. This allows unauthenticated attackers to log in as any existing user, including administrators, and to create new accounts.
Risk Assessment
An attacker can hijack an administrator account, gaining full control over the WooCommerce store, leading to customer data theft, product manipulation, and store downtime.
Recommendation
Immediately update the Happy Coders OTP Login for WooCommerce plugin to version 2.8 or later. If an update is not possible, temporarily disable the plugin until the patch is applied.
Original NVD description (English source)
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.