CVE-2026-12215 PUBLISHED

OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force

Assigner: Wordfence
Reserved: 14.06.2026 Published: 11.09.2026 Updated: 11.09.2026

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in process_otp_form is keyed exclusively on the attacker-controlled xoo_ml_user_ip_data cookie's ip_address field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic rand() function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (xoo_ml_login_with_otp) and verification endpoint (xoo_ml_otp_form_submit) are registered as unauthenticated wp_ajax_nopriv actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via wp_set_auth_cookie() in login_user_with_otp(). Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated xoo_ml_login_with_otp endpoint.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Product Status

Vendor xootix
Product OTP Login & Register Woocommerce
Versions Default: unaffected
  • affected from 0 to 2.7.2 (incl.)

Credits

  • d4ngvn finder

References

Problem Types

  • CWE-434 Unrestricted Upload of File with Dangerous Type CWE