Naimur Email OTP Verification for WooCommerce Authentication Bypass (CVE-2026-104014)

The Naimur Email OTP Verification for WooCommerce plugin for WordPress (versions 2.1.0 and earlier) contains an authentication bypass vulnerability in its password-reset finalization logic. The plugin's endpoint wp_ajax_nopriv_ceovw_update_new_password fails to validate session bindings, enforce timestamps, or require unique reset tokens. The vulnerability is compounded by a failure to clear verified database states, as the ceovw_cleanup_expired_otps_event cron job lacks an add_action handler. An unauthenticated attacker can exploit this by obtaining a publicly exposed nonce from the site and targeting an email address that previously verified an OTP, allowing them to overwrite the account password and obtain a valid session cookie.

Impact

Successful exploitation allows unauthenticated attackers to perform a full account takeover of any user who has initiated but not completed a password reset process. If the targeted account has administrative privileges, the attacker gains full control over the WordPress site.

Recommendation

• Inventory all WordPress sites running Naimur Email OTP Verification for WooCommerce.
• Disable or remove the plugin until a patch is released by the vendor.
• Audit WordPress user account activity and session logs for unusual password reset patterns or unexpected administrative login activity originating from unknown IP addresses.