CVE-2026-12215 Overview
CVE-2026-12215 is an authentication bypass vulnerability in the OTP Login & Register WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.7.2. Unauthenticated attackers can brute-force the One-Time Password (OTP) for any registered account, including administrator accounts, and obtain a valid WordPress authentication session. The vulnerability stems from a rate-limit counter keyed on an attacker-controlled cookie, an OTP generated with a non-cryptographic random function over only 9,000 possible values, and unauthenticated AJAX endpoints without nonce or capability checks. Exploitation requires knowledge of the target user's registered phone number.
Critical Impact
Unauthenticated attackers who know a user's registered phone number can brute-force the 4-digit OTP and take over any WordPress account, including administrators.
Affected Products
- WordPress plugin: OTP Login & Register WooCommerce (mobile-login-woocommerce)
- All versions up to and including 2.7.2
- WordPress sites running WooCommerce with this plugin enabled
Discovery Timeline
- 2026-09-11 - CVE-2026-12215 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-12215
Vulnerability Analysis
The vulnerability chains three independent weaknesses into a full authentication bypass. First, the OTP is generated using PHP's rand() function across the range 1000–9999, yielding only 9,000 possible values and no cryptographic strength. Second, the rate-limit attempt counter in process_otp_form is keyed exclusively on the ip_address field of the attacker-controlled xoo_ml_user_ip_data cookie. An attacker can reset the counter indefinitely by rotating the cookie value between attempts. Third, both the OTP issuance endpoint (xoo_ml_login_with_otp) and the verification endpoint (xoo_ml_otp_form_submit) are registered as wp_ajax_nopriv actions with no nonce or capability checks. Successful verification calls wp_set_auth_cookie() inside login_user_with_otp(), granting a full authenticated session for the target user. This maps to [CWE-434] as classified in NVD, though the exploitation pattern is fundamentally an authentication bypass through brute force.
Root Cause
The root cause is a combination of insecure random number generation, a client-controlled rate-limit key, and missing authentication and CSRF controls on OTP-related AJAX handlers. Each control that should have prevented brute forcing was either weak or bypassable from an unauthenticated context.
Attack Vector
An unauthenticated remote attacker triggers OTP issuance for a known phone number via the xoo_ml_login_with_otp endpoint. The attacker then submits OTP guesses to xoo_ml_otp_form_submit, rotating the xoo_ml_user_ip_data cookie's ip_address field between requests to reset the attempt counter. Because the OTP space is limited to 9,000 values, exhaustive guessing is feasible within a short window. Upon a correct guess, the server issues a WordPress auth cookie for the targeted account.
No verified exploit code has been published. See the Wordfence Vulnerability Analysis and the affected source files including OTP Handler Class and Verification Class for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-12215
Indicators of Compromise
- High volume of POST requests to admin-ajax.php with action=xoo_ml_otp_form_submit from one or more source addresses within a short window.
- Requests where the xoo_ml_user_ip_data cookie changes frequently across otherwise similar sessions or fingerprints.
- Successful WordPress login events (auth cookie issuance) immediately preceded by many failed OTP submissions for the same account.
- New administrative sessions or configuration changes originating from unfamiliar IP addresses following OTP traffic bursts.
Detection Strategies
- Alert on repeated wp_ajax_nopriv_xoo_ml_otp_form_submit calls exceeding a low per-account or per-IP threshold over a short interval.
- Correlate xoo_ml_login_with_otp issuance events with subsequent verification attempts to identify brute-force sequences targeting a single phone number.
- Track anomalous rotation of the xoo_ml_user_ip_data cookie value from the same TCP peer or TLS fingerprint.
Monitoring Recommendations
- Enable verbose WordPress and web-server access logging for all requests to admin-ajax.php involving the xoo_ml_* actions.
- Forward WordPress authentication events and WAF telemetry to a centralized log platform for correlation and retention.
- Review administrator account activity daily for unexpected logins, role changes, or plugin/theme modifications.
How to Mitigate CVE-2026-12215
Immediate Actions Required
- Update the OTP Login & Register WooCommerce plugin to the version released after 2.7.2 that addresses this issue; review the WordPress Change Set for OTP Handler to confirm fixed versions.
- If a patched version is not yet available in your environment, disable or uninstall the plugin until it can be updated.
- Force password and session resets for all WordPress accounts that use OTP login, prioritizing administrators.
- Audit user roles, recently added administrators, and plugin/theme files for signs of unauthorized modification.
Patch Information
The vendor has committed changes to the plugin repository referenced in the WordPress Change Set for OTP Handler. Administrators should install the latest available release from the WordPress plugin directory and verify the installed version is greater than 2.7.2.
Workarounds
- Deploy a Web Application Firewall (WAF) rule to rate-limit requests to admin-ajax.php where action=xoo_ml_otp_form_submit, keyed on source IP and TLS fingerprint rather than the client-supplied cookie.
- Block or challenge requests that rotate the xoo_ml_user_ip_data cookie value repeatedly from the same network peer.
- Restrict access to admin-ajax.php from geographies or networks that do not need OTP login functionality.
- Enforce multi-factor authentication for WordPress administrator accounts through an independent plugin that does not rely on the vulnerable OTP flow.
# Example WAF rate-limit pseudo-rule (adapt to your WAF syntax)
# Limit xoo_ml OTP submissions to 5 per minute per source IP
rule id: 100215
when: request.uri contains "/wp-admin/admin-ajax.php"
and request.body contains "action=xoo_ml_otp_form_submit"
then: rate_limit(source_ip, 5, 60s) -> block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
