Unrated severityNVD Advisory· Published Jul 16, 2026· Updated Jul 16, 2026
Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user
CVE-2026-12492
Description
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
Affected products
1- Range: <2.8
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/56fdcba6-c7b1-443d-9f9d-b738ecaadabc/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.