Description

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-21T08:16:44.160Z",
  "pubdate": "2026-08-21T08:16:44.160Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified in the Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress in versions up to, and including, 4.8.6. This critical security flaw allows unauthenticated remote attackers to achieve full authentication bypass and take over user accounts, including administrative accounts, by leveraging the disclosure of sensitive authentication tokens. The vulnerability stems from improper handling of secret magic login tokens within a publicly accessible OTP request endpoint. Attackers capable of targeting the web application require only a valid target user's email address to execute the exploit. The global impact of this vulnerability is severe, as successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected WordPress site, enabling malicious actors to execute arbitrary administrative actions, deploy backdoors, or pivot deeper into the underlying server infrastructure. Immediate remediation is required to prevent unauthorized access and potential system-wide compromise.",
  "technicalDetails": "The vulnerability resides within the handle_email_otp_return() function of the Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress. Specifically, affected versions up to, and including, 4.8.6 fail to properly segregate sensitive authentication data from public HTTP responses during the execution of email-based One-Time Password (OTP) requests.\nThe root cause of the authentication bypass is the insecure design and implementation of the OTP return mechanism. When a user or an attacker initiates an OTP request against the publicly accessible endpoint, the backend function handle_email_otp_return() erroneously includes the secret magic login token directly within the server response payload, rather than exclusively transmitting the token via out-of-band communication channels such as the user's registered email address.\nThe attack flow proceeds as follows: An unauthenticated attacker sends a crafted OTP request to the vulnerable endpoint specifying the email address of a targeted user, such as a site administrator. The application processes the request and generates the secret magic login token. Due to the insecure implementation in the handle_email_otp_return() function, the server returns the generated secret token directly in the HTTP response body to the requesting client. Upon capturing the secret magic login token from the response, the attacker bypasses standard authentication controls and utilizes the token to authenticate as the target user. Network exposure is high due to the public accessibility of the OTP request mechanism, requiring no prior authentication or administrative privileges to trigger the flaw.\nPost-exploitation impact includes full privilege escalation to administrative levels. Once authenticated as an administrator, the attacker can execute arbitrary code via plugin and theme installations, modify core application settings, harvest sensitive database contents, and compromise the underlying hosting environment."
}