CVE-2026-84110: Releasit COD Form Auth Bypass Vulnerability

CVE-2026-84110 Overview

CVE-2026-84110 affects the Releasit COD Form & Upsells plugin version 1. The flaw resides in the OTP (One-Time Password) Validation component. Attackers can bypass OTP verification by exploiting client-side enforcement of a control that should be validated server-side [CWE-602]. The issue is remotely exploitable and requires no authentication or user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic abuse against WordPress sites running the vulnerable version. Upgrading to version 2 resolves the issue.

Critical Impact
Remote attackers can bypass OTP validation in checkout workflows, enabling fraudulent cash-on-delivery orders and integrity abuse against affected storefronts.

Affected Products

Releasit COD Form & Upsells plugin, version 1
WordPress and WooCommerce storefronts using the affected plugin version
Cash-on-delivery checkout flows that rely on the plugin's OTP verification

Discovery Timeline

2026-09-01 - CVE-2026-84110 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84110

Vulnerability Analysis

The vulnerability is classified as client-side enforcement of server-side security [CWE-602]. The OTP Validation component in Releasit COD Form & Upsells version 1 relies on client-side logic to determine whether a submitted OTP is valid. Because the browser controls this check, attackers can manipulate requests or responses to satisfy validation without knowing the correct OTP. This defeats the intended purpose of OTP as an anti-fraud control on cash-on-delivery checkouts. The impact is limited to integrity of the OTP verification step, without direct effects on confidentiality or availability. Public disclosure of the technique lowers the barrier to exploitation. See the GitHub OTP Bypass Advisory and VulDB CVE-2026-84110 Details for reference material.

Root Cause

The plugin performs OTP validation in browser-side code rather than enforcing the check on the server. Server endpoints accept order submissions without independently verifying that the OTP entered by the user matches a value bound to the phone number and session. This design shifts a trust-sensitive control to a component the attacker fully controls.

Attack Vector

An unauthenticated remote attacker submits a crafted checkout request that skips or spoofs the OTP validation step. The attacker can intercept and modify HTTP traffic, disable client-side scripts, or replay requests to the order endpoint. Successful exploitation lets attackers place cash-on-delivery orders using arbitrary or unverified phone numbers.

No verified proof-of-concept code is available in this article. Refer to the GitHub OTP Bypass Advisory for technical exploitation details.

Detection Methods for CVE-2026-84110

Indicators of Compromise

Cash-on-delivery orders completing without a preceding successful OTP verification event in application logs
Repeated order submissions from the same IP address or user agent using varied phone numbers
HTTP requests to the plugin's order endpoint that omit or contain malformed OTP parameters
Spikes in failed delivery attempts or customer disputes tied to orders processed through the affected plugin

Detection Strategies

Correlate OTP issuance events with order completion events and alert on orders finalized without a matching validation record
Inspect web server and WordPress plugin logs for anomalous request patterns targeting the OTP endpoint
Deploy web application firewall (WAF) rules that require a valid server-issued OTP token on order submission

Monitoring Recommendations

Monitor WordPress plugin version inventory to identify hosts still running Releasit COD Form & Upsells v1
Track order-to-OTP ratios and alert on statistical deviations that suggest bypass activity
Ingest web server, WordPress, and WAF logs into a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2026-84110

Immediate Actions Required

Upgrade Releasit COD Form & Upsells to version 2, which resolves the client-side enforcement issue
Audit recent cash-on-delivery orders for fraudulent activity linked to unverified phone numbers
Restrict administrative access to the WordPress environment and review plugin change history
Enable WAF protections in front of the WordPress site to filter suspicious checkout traffic

Patch Information

The vendor has released version 2 of the Releasit COD Form & Upsells plugin, which addresses the OTP validation weakness. Administrators should upgrade the affected component to version 2 through the WordPress plugin management interface. Additional details are available in the VulDB CVE-2026-84110 Details reference.

Workarounds

Temporarily disable the Releasit COD Form & Upsells plugin until the upgrade to version 2 is applied
Require manual staff confirmation of cash-on-delivery orders before dispatch
Implement server-side rate limiting and CAPTCHA on the checkout endpoint to slow automated bypass attempts

bash

# Configuration example: upgrade the plugin via WP-CLI
wp plugin update releasit-cod-form --version=2
wp plugin list --name=releasit-cod-form --fields=name,version,status