CVE-2026-77264
CriticalCVSS 9.8Summary
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 4.8.6. The handle_email_otp_return() function returns the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email. This allows unauthenticated attackers to log in as any user, including administrators, if they know the user's email address.
Risk Assessment
An unauthenticated attacker can take over an administrator account, leading to full compromise of the WordPress site and potentially the server.
Recommendation
Immediately update the plugin to the latest version that fixes this vulnerability, and consider enforcing strong passwords and additional authentication methods.
Original NVD description (English source)
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.