Descrição
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user-s email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user-s email address.
CVSS 9.8EPSS 0.5680000000000001%Risco 1.03
Ver fonte- Publicação
- 2026-08-21 08:16:44
- Versões afetadas
- <=4.8.6
- Tipo
- Aplicação web
- Última alteração
- 2026-08-24 16:41:13
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H