CVE-2023-2706
OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation
- State
- Published
- Severity
- 8.1 High
- Published
- May 17, 2023
- Updated
- Apr 8, 2026
- Reserved
- May 15, 2023
Description
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | Wordfence |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
OTP Login & Register Woocommercexootix |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b1b7b653-496f-467a-9513-4be1891f38ae?source=cve
- https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.2/includes/class-xoo-ml-verification.php#L362
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912731%40mobile-login-woocommerce&new=2912731%40mobile-login-woocommerce&sfp_email=&sfph_mail=
- https://lana.codes/lanavdb/87b5e80e-fd5b-47c3-bf82-088bdf4573b5/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.