CVE-2026-110135
Received Received - Intake

One-Time Password Bypass in OTP Login & Register for WooCommerce

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110135
EUVD
EUVD-2026-102696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown OTP Login & Register Woocommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the OTP Login & Register Woocommerce WordPress plugin before version 2.7.3. It allows unauthenticated attackers to bypass one-time-password verification limits by manipulating a client-supplied value that tracks attempt limits. This enables brute-forcing short numeric login codes to take over accounts without a password.

Detection Guidance

To detect this vulnerability, monitor for repeated failed OTP login attempts targeting WordPress accounts. Check web server logs for excessive requests to the OTP verification endpoint, especially with varying client-supplied attempt limits. Look for patterns of short numeric code guessing attempts.

Impact Analysis

An attacker could exploit this to gain unauthorized access to user accounts by repeatedly guessing the OTP code. This could lead to account takeover, data theft, or unauthorized actions on behalf of the compromised user.

Compliance Impact

This vulnerability could violate compliance requirements related to authentication and access control, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized access risks data breaches and non-compliance penalties.

Mitigation Strategies

Immediately update the OTP Login & Register Woocommerce plugin to version 2.7.3 or later. Disable OTP-based login if not essential. Implement rate limiting on the OTP verification endpoint. Monitor for suspicious login activity and consider temporary account lockouts after multiple failed attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110135. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart