CVE-2026-77264 in Automation Web Platform Plugin
Summary
by MITRE • 08/21/2026
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within versions up to and including 4.8.6 of the Automation Web Platform plugins for WordPress, specifically affecting Notifications and OTP functionality along with Advanced Country Code features, represents a critical authentication bypass flaw rooted in improper handling of sensitive credentials during the one-time password verification process. This security defect fundamentally undermines the integrity of the multi-factor authentication mechanism intended to protect user accounts by exposing the underlying secret magic login token directly within HTTP responses accessible to unauthenticated parties. The core technical failure lies within the handle_email_otp_return function, which is designed to manage the return logic for OTP requests but fails to restrict access to the generated authentication secrets. Instead of securely delivering the one-time password solely through out-of-band channels such as email or SMS as intended by secure design principles, the system inadvertently includes this secret token in the body of the HTTP response sent back to the client initiating the request. This architectural oversight allows any individual with network-level access to intercept and extract these tokens simply by observing standard web traffic associated with OTP validation attempts.
From an operational perspective, this flaw enables unauthenticated attackers to achieve full administrative control over compromised WordPress installations without needing valid credentials for a specific user account beyond their email address. By knowing the target's email address, which is often publicly available through author archives or contact pages on many websites, an attacker can trigger the OTP request process and immediately capture the resulting magic login token from the server response. Possession of this token grants immediate access to the associated user session, effectively bypassing both password-based authentication and any additional security layers that rely on secret knowledge rather than possession factors. The impact is severe as it allows for complete site takeover, data exfiltration, defacement, or further lateral movement within networks where WordPress serves as a critical infrastructure component. This type of vulnerability aligns with CWE-287 Improper Authentication and CWE-359 Exposure of Private Information to an Unauthorized Actor, highlighting both the failure in verifying identity and the leakage of sensitive authentication material.
The exploitation vector for this issue is classified under ATT&CK technique T1078 Valid Accounts, as it involves using legitimate credentials or tokens obtained through improper means to gain access. Furthermore, because the token is returned via a standard HTTP response rather than being transmitted securely over an encrypted channel exclusively to the user's device, it also relates to CWE-209 Generation of Error Message Containing Sensitive Information. The ease of exploitation makes this vulnerability particularly dangerous in automated scanning environments where attackers can rapidly iterate through email addresses and harvest valid tokens for high-value accounts such as site administrators who possess elevated privileges capable of installing malicious plugins or modifying core files. Mitigation strategies must prioritize immediate patching to the latest version released by Automation Web Platform, which presumably corrects the handle_email_otp_return function to ensure that secret tokens are never echoed back in HTTP responses. Additionally, organizations should implement strict input validation and output encoding practices across all authentication endpoints while ensuring that security headers prevent caching of sensitive data. Regular audits of third-party plugin code for similar patterns where secrets are mishandled during API interactions or webhook processing can further reduce the attack surface against such authentication bypasses.