CVE-2026-104014 in Naimur Email OTP Verification for WooCommerce Plugin
Summary
by MITRE • 11/07/2026
The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/07/2026
The Naimur Email OTP Verification plugin for WordPress contains a critical authentication bypass vulnerability in versions up to 2.1.0, stemming from flawed logic within its password reset finalization mechanism. The core technical flaw resides in the wp_ajax_nopriv_ceovw_update_new_password action handler, which is responsible for processing new passwords during the reset flow. Instead of validating a unique, time-bound token associated with each specific reset request, the system relies solely on the existence of a database row indicating that an email address has been marked as verified. This design decision fundamentally undermines the security model by decoupling the verification status from the temporal context and session integrity required for secure authentication transitions.
The vulnerability is exacerbated by two distinct implementation failures within the plugin's codebase. First, the function responsible for marking OTPs as verified does not remove or invalidate the database record after a user successfully enters their code but before they finalize the password change. This creates a persistent state where any subsequent request can trigger the reset logic if that specific email address was previously part of an abandoned flow. Second, the plugin defines a scheduled cron event named ceovw_cleanup_expired_otps_event intended to clean up these stale records, yet there is no corresponding add_action handler registered in the codebase. Consequently, this cleanup routine never executes, allowing verified-but-unfinalized reset states to persist indefinitely in the database without any automated remediation.
From an operational perspective, this flaw allows unauthenticated attackers to perform account takeover attacks against users who have initiated a password reset but abandoned the process before setting a new password. The attacker requires only two pieces of information: the victim's email address and a nonce value. Fortunately for the attacker, the plugin inadvertently exposes this nonce by localizing it into the CEOVW_APP global JavaScript object on the WooCommerce account page accessible to logged-out visitors. With these elements in hand, an attacker can invoke the vulnerable endpoint directly, bypassing all intended security controls to overwrite the victim's password and immediately receive a valid wordpress_logged_in_ session cookie for that user.
The impact of this vulnerability is severe, particularly if the compromised account holds administrative privileges, as it results in full site takeover. This aligns with CWE-287, which describes Improper Authentication, specifically highlighting failures in verifying credentials or tokens during critical state transitions. Furthermore, the exploitation technique maps to MITRE ATT&CK T1078, Valid Accounts, where an adversary uses legitimate credentials obtained through unauthorized means to maintain access and escalate privileges within the target environment. The lack of session binding and token uniqueness represents a classic failure in implementing secure authentication protocols for password recovery workflows.
To mitigate this vulnerability, immediate action is required by updating the plugin to a patched version that addresses these logic flaws. Developers must ensure that reset tokens are unique per request, bound to specific sessions or IP addresses where feasible, and strictly time-limited with automatic expiration enforced both in memory and via properly registered cron jobs for database cleanup. Additionally, nonces should never be exposed globally on public-facing pages without strict validation against the current session context. Until an update is applied, site administrators should monitor login activity for anomalies and consider disabling password reset functionality temporarily if possible to prevent exploitation of this specific attack vector.