CVE-2026-110135
7.4HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-287
Impact
Unauthenticated attackers can brute-force numeric OTPs and take over arbitrary accounts over the network. They only need access to the site's login page and the victim's identifier.
Root cause
The plugin tracks OTP verification attempts using a client-supplied parameter that the user can alter on each request, completely bypassing rate limits.
Affected systems
OTP Login & Register Woocommerce WordPress plugin before 2.7.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade OTP Login & Register Woocommerce to version 2.7.3 or later. If patching immediately is not possible, disable the plugin or deactivate OTP-based authentication.
$ wp plugin update miniorange-otp-verificationAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.