CVE-2026-77264: WordPress WooCommerce OTP Plugin Auth Bypass

CVE-2026-77264 Overview

CVE-2026-77264 is an authentication bypass vulnerability in the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress. The flaw affects all versions up to and including 4.8.6. The handle_email_otp_return() function returns the secret magic login token in the HTTP response to a publicly accessible OTP request instead of delivering it exclusively to the user's registered email address. Unauthenticated attackers who know a valid user's email address can log in as that user, including administrators.

Critical Impact
Unauthenticated attackers can take over any WordPress account, including administrator accounts, by requesting an OTP and reading the login token from the HTTP response.

Affected Products

Automation Web Platform – Notifications and OTP for WooCommerce plugin for WordPress
Advanced Country Code plugin for WordPress
All versions up to and including 4.8.6

Discovery Timeline

2026-08-21 - CVE-2026-77264 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-77264

Vulnerability Analysis

The vulnerability resides in the plugin's OTP login workflow, specifically the handle_email_otp_return() function in class-wawp-otp-login.php. The function is designed to generate a one-time login token and email it to the account owner as a second factor. Instead, the implementation echoes the generated magic login token directly into the response returned to the requester.

Because the OTP endpoint is publicly accessible and does not require authentication, any remote user can trigger token generation for an arbitrary email address and read the token from the response body. The token then authenticates the requester as the targeted user, resulting in full account takeover.

The weakness is classified as [CWE-640] Weak Password Recovery Mechanism for Forgotten Password. Administrator email addresses are frequently exposed through post authorship metadata, WordPress REST API endpoints, or public contact forms, which lowers the barrier to exploitation.

Root Cause

The root cause is improper output handling in a sensitive authentication path. The OTP token must be treated as a secret bound to the out-of-band delivery channel, the user's inbox. Returning the token in the HTTP response collapses the second factor into the same channel used to request it, eliminating the authentication guarantee entirely.

Attack Vector

An attacker sends an unauthenticated HTTP request to the plugin's OTP endpoint supplying the target victim's email address. The vulnerable handler responds with a payload containing the magic login token. The attacker then submits the token to complete the OTP login flow and receives an authenticated session as the target user. See the WordPress OTP Login Class source and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-77264

Indicators of Compromise

Successful WordPress login events for administrator accounts without a preceding password authentication event.
New administrator or editor accounts created shortly after OTP endpoint requests.
HTTP requests to the plugin's OTP handler URLs originating from unexpected IP addresses or user agents.
Response bodies from the OTP endpoint containing token-like strings returned to the client.

Detection Strategies

Inspect web server access logs for repeated POST requests to the Automation Web Platform OTP endpoints targeting multiple email addresses.
Correlate OTP request events with subsequent authenticated sessions from the same source IP within a short time window.
Alert on WordPress wp_login events for privileged users where the authentication method is the OTP magic link rather than password.

Monitoring Recommendations

Monitor WordPress wp_users and wp_usermeta tables for unexpected role changes and new privileged accounts.
Enable audit logging for all authentication events and forward logs to a centralized SIEM for retention and correlation.
Track outbound requests from the WordPress host that indicate post-compromise activity such as plugin installation or file uploads.

How to Mitigate CVE-2026-77264

Immediate Actions Required

Update the Automation Web Platform plugin to a version later than 4.8.6 as soon as the vendor publishes a patched release.
Deactivate and remove the plugin from any WordPress site where a fixed version is not yet available.
Force a password reset and session invalidation for all administrator and privileged accounts on affected sites.
Review WordPress user tables for unauthorized accounts and role escalations created since the plugin was installed.

Patch Information

At the time of publication, no fixed version is confirmed in the enriched CVE data. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for a patched release addressing the handle_email_otp_return() token disclosure.

Workarounds

Restrict access to the plugin's OTP endpoints at the web server or WAF layer until a patched version is available.
Disable the email OTP login feature within the plugin configuration if the option is present.
Obscure administrator email addresses by disabling public author archives and REST API user enumeration.

bash

# Example: block the vulnerable OTP endpoint at the web server layer
# Nginx configuration snippet
location ~* /wp-admin/admin-ajax\.php {
    if ($arg_action ~* "wawp_otp") {
        return 403;
    }
}