Threat Investigation
Request a demo

CVE-2026-12492

Critical

Description

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.

SeverityCritical
CVSS9.8
Exploit probability43. percentile0.5%
ProductHappy Coders OTP Login for WooCommerce
PublishedJul 16, 2026
First seenJul 16, 2026
Weakness typeCWE-287Improper authentication

How to fix

Update
  • Happy Coders OTP Login for WooCommerce2.8 or later

Affected products

ProductAffected versionsFixed in
Happy Coders OTP Login for WooCommerce1.5 ≤ v < 2.82.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.