CVE-2026-110135: OTP Login & Register Woocommerce Auth Bypass

CVE-2026-110135 Overview

CVE-2026-110135 is an authentication weakness in the OTP Login & Register WooCommerce WordPress plugin before version 2.7.3. The plugin tracks one-time password (OTP) verification attempts against a value supplied by the client. An unauthenticated attacker can modify that client-controlled value to reset or bypass the attempt counter. This allows brute-force guessing of the short numeric login code and takeover of accounts without the password. The flaw is classified under [CWE-287: Improper Authentication].

Critical Impact

Unauthenticated attackers can brute-force the OTP code and take over any WooCommerce customer account, including those with elevated roles.

Affected Products

• OTP Login & Register WooCommerce WordPress plugin, all versions before 2.7.3
• WordPress sites running WooCommerce with the vulnerable plugin enabled
• Customer and administrator accounts protected by the plugin's OTP login flow

Discovery Timeline

• 2026-10-16 - CVE-2026-110135 published to the National Vulnerability Database (NVD)
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-110135

Vulnerability Analysis

The OTP Login & Register WooCommerce plugin issues a short numeric code to authenticate a user during login or registration. To prevent brute force, the plugin enforces a maximum number of verification attempts. The rate-limit counter is keyed to a value sent by the client with each verification request rather than a server-side identifier such as the authenticated session, server-stored nonce, or hashed phone identifier.

An attacker can change the client-supplied value with every attempt, which creates a fresh counter and resets the limit indefinitely. Because the OTP is a short numeric string, the keyspace is small enough to exhaust through automated requests. A successful guess authenticates the attacker as the targeted user and establishes a valid session.

Root Cause

The root cause is reliance on client-controlled state for a security-critical control. The plugin treats a parameter from the request as the identity against which attempt tracking is scoped. Server-side logic must bind rate-limit state to a value the client cannot forge, such as the target account identifier combined with the originating session or IP, stored and incremented atomically on the server.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker initiates the OTP login flow for a known user identifier such as an email address or phone number. The attacker then submits automated verification requests, rotating the client-supplied counter key on each try while iterating the numeric OTP space. Once a code matches, the plugin issues a valid session for the targeted account.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-110135

Indicators of Compromise

• High volumes of POST requests to the plugin's OTP verification endpoint from a single source address within a short window
• Successful authentication events for accounts immediately preceded by dozens or hundreds of failed OTP verifications
• WooCommerce session or user login events originating from IP addresses that have never previously accessed the account

Detection Strategies

• Review web server and WordPress audit logs for repeated calls to the OTP verification handler where the client-supplied tracking parameter varies while the target user identifier remains constant
• Correlate failed OTP responses with subsequent wp_login success events for the same account within a short time delta
• Deploy a WordPress security plugin or Web Application Firewall (WAF) rule that counts OTP verification requests per target identifier server-side

Monitoring Recommendations

• Alert on more than 10 OTP verification requests per minute targeting a single account from any single source
• Monitor new administrator or customer logins from previously unseen IP addresses or user agents
• Forward WordPress authentication and WooCommerce order logs to a centralized data lake for correlation and retention

How to Mitigate CVE-2026-110135

Immediate Actions Required

• Update the OTP Login & Register WooCommerce plugin to version 2.7.3 or later on every affected WordPress site
• Audit recent login activity and WooCommerce orders for signs of account takeover, focusing on password-less logins
• Force a password reset and session invalidation for accounts that show suspicious OTP verification activity

Patch Information

The vendor addressed the issue in version 2.7.3 of the OTP Login & Register WooCommerce plugin. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin files. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Disable or uninstall the OTP Login & Register WooCommerce plugin until the patched version can be deployed
• Enforce a WAF rule that rate-limits requests to the OTP verification endpoint per source IP and per target account
• Require a stronger second factor such as email-based magic links or an authenticator app until the plugin is updated

# Example WP-CLI command to update the plugin to the fixed version
wp plugin update otp-login-woocommerce --version=2.7.3