CVE-2026-104014 Details

A vulnerability allowing authentication bypass has been identified in the Naimur Email OTP Verification for WooCommerce plugin for WordPress, affecting versions through 2.1.0. The issue arises because the plugin's password-reset finalization endpoint authorizes password resets based solely on the presence of a database row marking an email as 'VERIFIED'. This authorization method lacks essential security measures, such as a timestamp check, session binding, and a per-reset token. Additionally, the function that verifies OTPs for password resets leaves the verification status active, allowing abandoned verification processes to be exploited. A scheduled cleanup event for expired OTPs is also ineffective, as it lacks the necessary action handler, leading to a buildup of verifiable states that can be exploited. As a result, unauthenticated attackers can take over accounts by using the victim's email address and a nonce that the plugin publicly localizes for logged-out visitors on the WooCommerce account page. After calling the vulnerable endpoint to reset the password, attackers receive a live session cookie for the user, enabling full site takeover, particularly if the compromised account belongs to an administrator.

Users are advised to update the Naimur Email OTP Verification for WooCommerce plugin to version 2.1.1 or a newer patched version.