All vulnerabilities
CVE-2026-110135

OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

Unknown OTP Login & Register Woocommerce
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.7.3Fixed versionCVE List
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 2.7.3OTP Login & Register WoocommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

Text from CVE List

Affected versions 1

  • OTP Login & Register Woocommerceaffected: all versions before 2.7.3CVE List

References 1