naimurrahmannahid vulnerabilities and threats

Naimur Email OTP Verification for WooCommerce plugin versions up to 2.1.0 contains an authentication bypass vulnerability. The flaw arises from the password-reset finalization endpoint authorizing resets solely based on an email marked as 'VERIFIED' in the database, without timestamp checks, session binding, or per-reset tokens. This allows unauthenticated attackers who know a victim's email and a publicly available nonce to reset the victim's password and obtain a valid session cookie, potentially leading to full site takeover if the victim is an administrator.