Executive brief
The Automation Web Platform – Notifications and OTP for WooCommerce plugin for WordPress contains a critical authentication vulnerability in its OTP login feature. The plugin incorrectly returns the secret magic login token in the HTTP response to OTP requests instead of delivering it only via email, allowing attackers to log in as any user (including administrators) if they know their email address.
Technical details
The vulnerability is an authentication bypass in the handle_email_otp_return() function of the plugin's OTP login implementation. When a user requests an OTP, the function returns the secret magic login token in the publicly accessible response rather than restricting delivery to the user's email address. The vulnerability requires only knowledge of a target user's email address and network access to the OTP endpoint—no prior authentication is needed. An unauthenticated attacker can obtain valid login tokens for any user account, including administrator accounts, and use them to gain complete control of the WordPress site. The vulnerability affects all versions up to and including 4.8.6.
Affected products
- Automation Web Platform Notifications and OTP for WooCommerce up to 4.8.6
Timeline
- 2026-08-21: disclosed