CVE-2026-110135: OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

Q: Who is exposed to account takeover?

Accounts that can authenticate through the plugin's OTP login flow are exposed. An unauthenticated attacker can target an account without knowing its password.

Q: What does an attacker need to exploit this issue?

The attacker needs access to the OTP verification flow and must be able to repeatedly submit guesses for the short numeric login code. The flawed attempt limit can be bypassed because its tracked value is supplied by the client.

Q: Are installations running version 2.7.3 affected?

The issue is described as affecting plugin versions before 2.7.3. Version 2.7.3 is not identified as affected in the provided information.

Published Oct 16, 2026

Updated

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

Affected Software

1 affected component

WordPress OTP Login & Register Woocommerce<2.7.3

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to account takeover?

Accounts that can authenticate through the plugin's OTP login flow are exposed. An unauthenticated attacker can target an account without knowing its password.

What does an attacker need to exploit this issue?

The attacker needs access to the OTP verification flow and must be able to repeatedly submit guesses for the short numeric login code. The flawed attempt limit can be bypassed because its tracked value is supplied by the client.

Are installations running version 2.7.3 affected?

The issue is described as affecting plugin versions before 2.7.3. Version 2.7.3 is not identified as affected in the provided information.

CVE-2026-110135: OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

Affected Software

Event History

Frequently Asked Questions

Who is exposed to account takeover?

What does an attacker need to exploit this issue?

Are installations running version 2.7.3 affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to account takeover?

What does an attacker need to exploit this issue?

Are installations running version 2.7.3 affected?