xootix OTP Login & Register Woocommerce Plugin up to 2.7.2 on WordPress OTP Rate Limit login_user_with_otp ip_address excessive authentication

Summaryinfo

A vulnerability identified as problematic has been detected in xootix OTP Login & Register Woocommerce Plugin up to 2.7.2. This affects the function login_user_with_otp of the component OTP Rate Limit. Performing a manipulation of the argument ip_address results in excessive authentication. This vulnerability is reported as CVE-2026-12215. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in xootix OTP Login & Register Woocommerce Plugin up to 2.7.2. This affects the function login_user_with_otp of the component OTP Rate Limit. The manipulation of the argument ip_address with an unknown input leads to a excessive authentication vulnerability. CWE is classifying the issue as CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. This is going to have an impact on confidentiality. The summary by CVE is:

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint.

It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2026-12215 since 06/14/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• xootix

Name

• OTP Login & Register Woocommerce Plugin

Version

• 2.7.0
• 2.7.1
• 2.7.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion