CVE-2026-12215 xootix CVE debrief

Who should care

Defenders responsible for WordPress installations using the OTP Login & Register Woocommerce plugin, especially those with administrator accounts, should assess exposure and prioritize remediation.

Why it matters

This vulnerability allows unauthenticated attackers to bypass authentication and potentially gain administrative access to WordPress installations using the affected plugin. Defenders should verify and remediate this vulnerability, especially for administrator accounts.

• Unauthenticated attackers can brute-force OTPs for any registered account
• Attackers can obtain a full WordPress authentication session for administrator accounts
• Requires verification of affected versions and remediation priority
• Exposure requires defenders to verify and remediate the vulnerability

Technical summary

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force due to a flawed rate-limiting mechanism and weak OTP generation. Attackers can brute-force OTPs for registered accounts, including administrator accounts, without authentication. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999). Both the OTP issuance and

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with administrator accounts that could be targeted.

Recommended defensive actions

• Verify and remediate this vulnerability in WordPress installations
• Restrict access to the OTP issuance and verification endpoints
• Implement additional security measures for administrator accounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability details are based on the CVE record and source references provided by [email protected]. The information includes specifics about the affected plugin, the nature of the vulnerability, and potential attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.