CVE-2026-77264: Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPressto a version that resolves this vulnerability.Fixed in 4.8.6 - Operational
Rotate/renew any credentials and invalidate existing sessions/tokens for Automation Web Platform users, since unauthenticated attackers may have been able to log in as any user if they knew the user's email address.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it if they know the email address of a user on the affected WordPress site. The attacker can target any account, including administrator accounts.
What does an attacker need to obtain to log in as another user?
The attacker needs the target user's email address. A publicly accessible OTP request can disclose the secret magic-login token in its response, allowing the attacker to authenticate as that user.
Are administrator accounts at risk?
Yes. The disclosed token can allow an attacker to log in as any user whose email address they know, explicitly including administrators.
Which plugin versions are affected?
Versions up to and including 4.8.6 are affected. The provided information does not identify a fixed version.