CVE-2026-12215 in OTP Login & Register Woocommerce Plugin
Summary
by MITRE • 09/11/2026
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The One-Time Password Login and Register plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up through 2.7.2. This flaw stems from multiple compounding security failures in how the system handles OTP generation, validation, and session management. The core issue lies in the implementation of rate-limiting mechanisms designed to prevent brute-force attacks against one-time passwords. Specifically, the attempt counter within the process_otp_form function relies exclusively on an IP address value extracted from a user-controlled cookie named xoo_ml_user_ip_data. Because this identifier is entirely attacker-controllable, malicious actors can trivially bypass anti-brute-force protections by simply rotating or changing their cookie values between attempts. This effectively nullifies any intended throttling mechanism, allowing for unlimited authentication trials without triggering account lockouts or CAPTCHA challenges that would normally mitigate such attacks.
Beyond the rate-limiting failure, the cryptographic strength of the OTP itself is severely compromised. The plugin utilizes PHP's rand() function to generate these codes, which is a non-cryptographically secure pseudo-random number generator unsuitable for security-sensitive applications. Furthermore, the default configuration restricts the OTP space to only four digits ranging from 1000 to 9999. This results in a search space of merely nine thousand possible values. When combined with the ability to reset rate limits at will, this small entropy pool makes brute-forcing the code computationally trivial and rapid. An attacker can exhaustively test all possible combinations within seconds using automated scripts, significantly lowering the barrier for exploitation compared to standard cryptographic standards that typically require six or more digits generated via secure random sources like openssl_random_pseudo_bytes or similar CSPRNG implementations.
The vulnerability is exacerbated by improper access control configurations on the underlying WordPress AJAX endpoints. Both the endpoint responsible for issuing OTPs and the endpoint used for verifying them are registered as unauthenticated actions using wp_ajax_nopriv hooks. These handlers lack nonce verification checks and do not enforce any capability requirements before processing requests. This design allows completely unauthenticated external actors to interact directly with these functions without prior login or permission validation. The xoo_ml_login_with_otp endpoint can be triggered by anyone who knows the target user's registered phone number, allowing them to request OTP codes for specific accounts. Subsequently, the verification endpoint accepts and processes guesses from any source, creating a direct path to authentication bypass if the correct code is guessed during the brute-force process.
Successful exploitation of this vulnerability allows an unauthenticated attacker to gain full administrative access to the WordPress installation. Upon correctly guessing the OTP, the system invokes login_user_with_otp which calls wp_set_auth_cookie() to establish a valid session for the targeted user account. This means that if the target is an administrator, the attacker gains complete control over the website, including the ability to modify content, install malicious plugins, access sensitive databases, and compromise other users' data. The impact extends beyond simple unauthorized login; it represents a total compromise of site integrity and confidentiality due to the elevation of privileges inherent in accessing admin-level accounts through this flawed authentication flow.
Mitigation strategies must address both the immediate technical flaws and broader architectural weaknesses. Immediate remediation involves upgrading the plugin to version 2.7.3 or later, where these specific issues have been addressed by developers. In cases where updating is not immediately feasible, administrators should consider disabling OTP login functionality entirely if it is not strictly required for their use case. Additionally, implementing server-side rate limiting based on persistent identifiers such as IP addresses combined with user agents can help mitigate brute-force attempts even before the application layer processes them. It is also critical to ensure that all sensitive endpoints utilize nonces and capability checks to prevent unauthorized access.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication due to insufficient authentication controls and CWE-330 Use of Insufficiently Random Values for cryptographic operations. The exploitation technique maps directly to the MITRE ATT&CK framework under T1110 Brute Force, specifically noting the use of password guessing attacks against web applications. Security auditors should review similar implementations in other plugins that rely on weak random number generators or cookie-based session tracking for security-critical functions like two-factor authentication. Ensuring compliance with OWASP guidelines regarding secure randomness and proper access control is essential to prevent recurrence of such vulnerabilities in future development cycles.