CVE-2026-12492
CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
Affected Platforms (CPE)
No CPE configurations currently published for this record.