AI analysis
Claude Opus · 9 Nov 2026, 10:20 CET
Email OTP Verification for WooCommerce plugin allows account takeover
A critical authentication bypass in the Naimur Email OTP Verification for WooCommerce plugin (versions up to and including 2.1.0) lets unauthenticated attackers reset passwords and take over accounts, including administrators. Upgrade to a fixed version immediately.
In plain terms
This is a flaw in a WordPress plugin called Email OTP Verification for WooCommerce, made by Naimur. The plugin is meant to verify shoppers using a one-time code (OTP) sent by email, including during password resets. Because of a design mistake, the plugin treats an email as permanently "verified" once a code is entered, and never cleans up that status. An attacker who knows a victim's email address can then finish a password reset the victim started but did not complete, set a new password, and be logged in as that user.
Anyone running a WooCommerce store with this plugin should pay attention. If the hijacked account is an administrator, the attacker gains full control of the site.