# CVE-2026-110135: OTP Login & Register Woocommerce authentication bypass via OTP brute force

Source: https://junglewise.ai/threats/cve-2026-110135-the-otp-login-register-woocommerce-wordpress-plugin-before-2-7-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110135 · Severity: high · CVSS 7.4 · Published 2026-10-16

The OTP Login & Register Woocommerce WordPress plugin uses a client-side verification attempt limit for one-time passwords, allowing attackers to bypass the limit and brute-force the short numeric login code. An attacker without a password can use this weakness to take over any account on a site using the plugin.

## Quick answers

**Is CVE-2026-110135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110135 being exploited in the wild.

**How severe is CVE-2026-110135?** High severity, with a CVSS score of 7.4, published 16 October 2026.

**Which products and versions are affected?** OTP Login & Register Woocommerce before 2.7.3.

**Is there a fix for CVE-2026-110135?** Yes: fixed in 2.7.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110135 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110135?** Check whether you run OTP Login & Register Woocommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.3

## Technical details

The plugin tracks OTP verification attempt limits against a client-supplied value that can be freely modified, enabling an unauthenticated attacker to bypass rate limiting. By brute-forcing the short numeric code without attempt restrictions, an attacker can complete a full account takeover. The vulnerability affects versions before 2.7.3.

## Affected products

- OTP Login & Register Woocommerce before 2.7.3

## Timeline

- 2026-10-14: disclosed
- 2026-10-16: advisory

## References

- [https://wpscan.com/vulnerability/73f0e85d-c145-4048-9fbd-20308d163b87/](https://wpscan.com/vulnerability/73f0e85d-c145-4048-9fbd-20308d163b87/)

## Related threats

- [OTP Login & Register Woocommerce stored cross-site scripting in fb-config](https://junglewise.ai/threats/cve-2026-12402-the-otp-login-register-woocommerce-plugin-for-wordpress-is)