CVE-2026-12215 affects the OTP Login & Register Woocommerce WordPress plugin versions up to 2.7.2. The vulnerability allows unauthenticated attackers to bypass authentication by brute forcing OTPs. The OTP rate-limit counter is keyed on a cookie value controlled by the attacker, allowing unlimited resets. OTPs are generated using PHP's rand() function over only 9000 possible values, making brute force feasible. Both OTP issuance and verification endpoints are unauthenticated wp_ajax_nopriv actions without nonce or capability checks. Successful exploitation grants a full WordPress authentication session via wp_set_auth_cookie(), including for administrator accounts. Exploitation requires knowledge of the target's registered phone number to trigger OTP issuance.

An attacker who knows a target user's registered phone number can brute-force the OTP to gain unauthorized access to that user's WordPress account, including administrator accounts. This leads to a full authentication bypass without needing valid credentials. The vulnerability does not impact confidentiality but allows integrity compromise through unauthorized login. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the OTP endpoints if possible, monitor for suspicious OTP requests, and consider disabling the OTP login feature. Avoid relying on this plugin for authentication in sensitive environments until patched.