{"id":"CVE-2026-110135","kind":"vulnerability","aliases":["CVE-2026-110135"],"related":[],"title":"WordPress OTP Login plugin lets attackers brute-force one-time codes and take over accounts","description":"The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.","summary":"The OTP Login & Register WooCommerce plugin before 2.7.3 tracks its OTP attempt limit against a value the client controls, so the limit can be reset freely. An unauthenticated attacker can brute-force the short numeric login code and sign in to an account without knowing its password.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["otp-login-disabled","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the OTP Login & Register Woocommerce plugin in the WordPress admin plugin list, or run `wp plugin get <plugin-slug> --field=version` with WP-CLI\n- Confirm whether the plugin is active on the site","fix":"- Update the OTP Login & Register Woocommerce plugin to `2.7.3` or later\n- If an update is not possible, deactivate the plugin until it is patched","status":"open","published_at":"2026-10-16T07:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:27:20+00:00","updated_at":"2026-10-25T03:27:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update the OTP Login & Register Woocommerce plugin to `2.7.3` or later\n- If an update is not possible, deactivate the plugin until it is patched","reach":"internet","title":"WordPress OTP Login plugin lets attackers brute-force one-time codes and take over accounts","impact":"high","summary":"The OTP Login & Register WooCommerce plugin before 2.7.3 tracks its OTP attempt limit against a value the client controls, so the limit can be reset freely. An unauthenticated attacker can brute-force the short numeric login code and sign in to an account without knowing its password.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over customer or admin accounts without the password","analyst_note":"Check the NVD entry and the plugin changelog for the exact fixed version and whether OTP login is enabled by default.","how_to_check":"- Check the installed version of the OTP Login & Register Woocommerce plugin in the WordPress admin plugin list, or run `wp plugin get <plugin-slug> --field=version` with WP-CLI\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version","otp-login-disabled"],"who_is_affected":"Sites running the OTP Login & Register Woocommerce WordPress plugin before 2.7.3 with OTP login enabled are exposed, since the flaw is in the login code verification step. Sites that do not use the plugin, or run a patched version, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000635,"input_tokens":3338,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110135':20A,23A '-2026':19A,22A '2.7.3':37B,86C 'account':17A,73B,135C 'adequ':89C 'allow':114C 'attack':6A,58B,117C 'attempt':41B,96C,99C 'brute':8A,61B,124C 'brute-forc':7A,60B,123C 'bypass':119C 'chang':112C 'client':47B,107C 'code':13A,67B,130C 'control':48B 'cve':18A,21A 'forc':9A,62B,125C 'freeli':55B,113C 'host':27B 'know':75B 'let':5A 'limit':42B,51B,90C,100C,121C 'login':3A,32B,66B,80C,129C 'numer':65B,128C 'one':11A,92C 'one-tim':10A 'one-time-password':91C 'otp':2A,31B,40B,79C 'packag':24B 'password':77B,94C,138C 'plugin':4A,35B,84C 'regist':33B,81C 'reset':54B 'self':26B 'self-host':25B 'short':64B,127C 'sign':69B 'suppli':109C 'take':15A,132C 'time':12A,93C 'track':38B,102C 'unauthent':57B,116C 'valu':45B,105C 'verif':95C 'without':74B,136C 'woocommerc':28B,34B,82C 'wordpress':1A,29B,83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the OTP Login & Register Woocommerce WordPress plugin before 2.7.3 with OTP login enabled are exposed, since the flaw is in the login code verification step. Sites that do not use the plugin, or run a patched version, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110135","severity":null,"published_at":"2026-10-16T07:17:10+00:00","modified_at":"2026-10-16T15:17:09+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}