Executive brief
The OTP Login & Register plugin for WordPress, used to secure WooCommerce store logins with one-time passcodes, contains a critical flaw that allows attackers to bypass authentication and gain unauthorized access to any user account, including administrator accounts. An attacker can exploit weak OTP generation and a flawed rate-limiting mechanism to systematically guess valid passcodes within seconds, then authenticate as the targeted user without needing their password.
Technical details
The plugin generates OTPs using PHP's non-cryptographic rand() function over a limited keyspace of only 9,000 possible values (1000–9999), combined with a rate-limit counter that is keyed exclusively on an attacker-controlled cookie field, allowing unlimited resets via cookie rotation. Both the OTP issuance endpoint (xoo_ml_login_with_otp) and verification endpoint (xoo_ml_otp_form_submit) are registered as unauthenticated wp_ajax_nopriv actions with no nonce or capability checks. An unauthenticated attacker who knows the target's phone number can trigger OTP issuance, then brute-force the OTP by rotating the cookie to bypass rate limits, and finally call login_user_with_otp() to establish a wp_set_auth_cookie() session. No patch is currently available; the vulnerability affects all versions through 2.7.2.
Affected products
- Xootix OTP Login & Register Woocommerce up to and including 2.7.2
Timeline
- 2026-09-11: disclosed