Is CVE-2026-12215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12215 being exploited in the wild.

How severe is CVE-2026-12215?

Medium severity, with a CVSS score of 5.3, published 11 September 2026.

Which products and versions are affected?

Xootix OTP Login & Register Woocommerce up to and including 2.7.2.

Is there a fix for CVE-2026-12215?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12215 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12215?

Check whether you run Xootix OTP Login & Register Woocommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12215: WordPress OTP Login Register Woocommerce authentication bypass via OTP brute force

CVE-2026-12215 · Severity: medium · CVSS 5.3 · Published 2026-09-11

The OTP Login & Register plugin for WordPress, used to secure WooCommerce store logins with one-time passcodes, contains a critical flaw that allows attackers to bypass authentication and gain unauthorized access to any user account, including administrator accounts. An attacker can exploit weak OTP generation and a flawed rate-limiting mechanism to systematically guess valid passcodes within seconds, then authenticate as the targeted user without needing their password.

Technologies: Xootix OTP Login & Register Woocommerce. Vendors: Xootix.

Quick answers

Is CVE-2026-12215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12215 being exploited in the wild.
How severe is CVE-2026-12215?: Medium severity, with a CVSS score of 5.3, published 11 September 2026.
Which products and versions are affected?: Xootix OTP Login & Register Woocommerce up to and including 2.7.2.
Is there a fix for CVE-2026-12215?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12215 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12215?: Check whether you run Xootix OTP Login & Register Woocommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin generates OTPs using PHP's non-cryptographic rand() function over a limited keyspace of only 9,000 possible values (1000–9999), combined with a rate-limit counter that is keyed exclusively on an attacker-controlled cookie field, allowing unlimited resets via cookie rotation. Both the OTP issuance endpoint (xoo_ml_login_with_otp) and verification endpoint (xoo_ml_otp_form_submit) are registered as unauthenticated wp_ajax_nopriv actions with no nonce or capability checks. An unauthenticated attacker who knows the target's phone number can trigger OTP issuance, then brute-force the OTP by rotating the cookie to bypass rate limits, and finally call login_user_with_otp() to establish a wp_set_auth_cookie() session. No patch is currently available; the vulnerability affects all versions through 2.7.2.

Affected products

Xootix OTP Login & Register Woocommerce up to and including 2.7.2

Timeline

2026-09-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.