CVE-2023-2706

HIGH

OTP Login Woocommerce & Gravity Forms < 2.3 - Unauthenticated Authentication Bypass via OTP Code Exposure

Title source: llm
STIX 2.1

Description

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.

References (4)

Core 4

Scores

CVSS v3 8.1
EPSS 0.0172
EPSS Percentile 74.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-287
Status published
Products (2)
xootix/OTP Login & Register Woocommerce < 2.2
xootix/otp_login_woocommerce_\&_gravity_forms < 2.3
Published May 17, 2023
Tracked Since Feb 18, 2026