Live › vulnerability › CVE-2026-110135
Go to dashboardThe OTP Login & Register WooCommerce plugin before 2.7.3 tracks its OTP attempt limit against a value the client controls, so the limit can be reset freely. An unauthenticated attacker can brute-force the short numeric login code and sign in to an account without knowing its password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the OTP Login & Register Woocommerce WordPress plugin before 2.7.3 with OTP login enabled are exposed, since the flaw is in the login code verification step. Sites that do not use the plugin, or run a patched version, can skip this.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version with WP-CLI2.7.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.
This page as .md · .json · in your agent: get_signal("CVE-2026-110135")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.