CVE-2026-104014

Name of the Vulnerable Software and Affected Versions Naimur Email OTP Verification for WooCommerce versions prior to 2.1.1

Description An authentication bypass exists in the password-reset finalization process. The endpoint wp ajax nopriv ceovw update new password handled by the function update new password() authorizes resets based only on a database row marked as 'VERIFIED'. This occurs because the system lacks timestamp checks, session binding, and per-reset tokens. Furthermore, the mark otp as verified for reset() function leaves the verification row active if a user abandons the flow, and the scheduled cleanup event ceovw cleanup expired otps event lacks a handler, meaning expired entries are never removed. An unauthenticated attacker can take over accounts, including administrator accounts, by using a victim's email address and a nonce localized publicly in the CEOVW APP global on the WooCommerce account page. Successful exploitation allows the attacker to overwrite the password and receive a wordpress logged in session cookie.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.