CVE-2026-77264: CWE-640 Weak Password Recovery Mechanism for Forgotten Password in 101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code

CVE-2026-77264 is an authentication bypass vulnerability in the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin. Versions up to and including 4.8.6 are affected. The vulnerability is due to the handle_email_otp_return() function returning the secret magic login token in the HTTP response to an OTP request, which is publicly accessible. This allows unauthenticated attackers to obtain the token and log in as any user if they know the user's email address. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

An unauthenticated attacker can bypass authentication and log in as any user on the affected WordPress site, including administrators, by exploiting the exposure of the secret magic login token. This compromises the confidentiality, integrity, and availability of the site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the OTP request endpoint if possible and monitor for suspicious activity related to OTP requests. Avoid using affected versions (<=4.8.6) in production environments.