Vulnerability · Published Jul 16, 2026 · Assigned by WPScan
CVE-2026-12492Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user
Critical 9.8
In plain English
A critical-severity improper authentication in Happy Coders OTP Login for WooCommerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 57.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Happy Coders OTP Login for WooCommerce | 1.5 – before 2.8 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/56fdcba6-c7b1-443d-9f9d-b738ecaadabc/ exploit, vdb-entry, technical-description