CVE-2026-104014
Deferred Deferred - Pending Action

Authentication Bypass in Naimur Email OTP Verification for WooCommerce

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-104014
EUVD
EUVD-2026-119159

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
naimurrahmannahid Naimur Email OTP Verification for WooCommerce From 0 (inc) to 2.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the Naimur Email OTP Verification for WooCommerce plugin for WordPress. It allows unauthenticated attackers to take over any account by resetting the password if the victim previously requested a password reset code but did not complete the process. The flaw exists because the plugin does not properly validate the reset request, leaving a 'VERIFIED' email row in the database without expiration or session binding.

Detection Guidance

Check if the Naimur Email OTP Verification for WooCommerce plugin version 2.1.0 or lower is installed. Inspect WordPress cron jobs for the 'ceovw_cleanup_expired_otps_event' task, which may not have a registered handler. Look for unauthorized password reset attempts or unexpected admin account access.

Impact Analysis

If you use this plugin, an attacker could take over your WordPress account, including admin accounts, by knowing your email address. They can reset your password and gain full access to your site. This could lead to data theft, malware installation, or site defacement.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. A breach may result in legal penalties, loss of customer trust, and compliance fines.

Mitigation Strategies

Immediately update the Naimur Email OTP Verification for WooCommerce plugin to the latest version. Disable the plugin if no update is available. Review user accounts for unauthorized changes and revoke suspicious sessions. Monitor for unusual login activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...