CVE-2026-12492

Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.

Affected

Happy Coders OTP Login for WooCommerce

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.50% chance of exploitation in the next 30 days, 41st percentile

Published

2026-07-16

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/56fdcba6-c7b1-443d-9f9d-b738ecaadabc/

References

• CVE Record
• NVD entry