CVE-2026-77264 is an authentication bypass vulnerability in the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin. The vulnerability arises from the handle_email_otp_return() function improperly returning the secret magic login token directly in the response to OTP requests, which are publicly accessible. This behavior enables attackers without authentication to obtain the token and log in as any user if they know the user's email address. The vulnerability affects versions up to and including 4.8.6. The CVSS 3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

An unauthenticated attacker can bypass authentication and log in as any user, including administrators, if the attacker knows the user's email address. This leads to full compromise of the affected WordPress site, including complete control over site content, settings, and potentially sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the OTP request endpoint if possible and monitor for suspicious activity related to OTP requests. Avoid using affected versions in production environments where possible.