The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled xoomluseripdata cookie's ipaddress field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic rand() function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (xoomlloginwithotp) and verification endpoint (xoomlotpformsubmit) are registered as unauthenticated wpajaxnopriv actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via wpsetauthcookie() in loginuserwithotp(). Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated xoomlloginwithotp endpoint.