The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | OTP Login & Register Woocommerce | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 16 Oct 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password. | |
| Title | OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-10-16T06:00:15.231Z
Reserved: 2026-10-13T16:45:54.879Z
Link: CVE-2026-110135
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-16T07:17:10.683
Modified: 2026-10-16T07:17:10.683
Link: CVE-2026-110135
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.