CVE-2026-12215: OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled xoomluseripdata cookie's ipaddress field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic rand() function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (xoomlloginwithotp) and verification endpoint (xoomlotpformsubmit) are registered as unauthenticated wpajaxnopriv actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via wpsetauthcookie() in loginuserwithotp(). Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated xoomlloginwithotp endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
woocommerce/OTP Login & Register Woocommerce pluginto a version that resolves this vulnerability.Fixed in 2.7.2 - Compensating control
Block or restrict unauthenticated access to the plugin’s unauthenticated AJAX endpoints registered as `wp_ajax_nopriv` actions: `xoo_ml_login_with_otp` (OTP issuance) and `xoo_ml_otp_form_submit` (OTP verification), since they perform no nonce or capability checks.
Event History
Frequently Asked Questions
Which users can be targeted?
Any registered account whose phone number is known to the attacker can be targeted, including WordPress administrator accounts. Successful exploitation results in a WordPress authentication session for the selected account.
Does the default OTP configuration limit the practical risk?
No. The default OTP range contains only 9,000 values, from 1000 through 9999. The attempt counter can be reset by changing the attacker-controlled ip_address field in the xoo_ml_user_ip_data cookie, enabling repeated brute-force attempts.
What does an attacker need before attempting exploitation?
The attacker needs the target account's registered phone number to request an OTP. They do not need to be authenticated, and the OTP issuance and verification actions do not require a nonce or capability check.