Περιγραφή
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user-s email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user-s email address.
CVSS 9.8EPSS 0.5680000000000001%Κίνδυνος 1.03
Προβολή πηγής- Δημοσίευση
- 2026-08-21 08:16:44
- Επηρεαζόμενες εκδόσεις
- <=4.8.6
- Τύπος
- Εφαρμογή ιστού
- Τελευταία τροποποίηση
- 2026-08-24 16:41:13
- Διάνυσμα
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H