The vulnerability arises from the Naimur Email OTP Verification for WooCommerce plugin allowing an unauthenticated attacker to override a user's password after the user has verified a reset code but abandoned the final step. The endpoint wp_ajax_nopriv_ceovw_update_new_password authorizes password changes solely on the presence of a 'VERIFIED' row in the database, with no expiration, session linkage, or unique reset token. An attacker who knows the victim’s email and the publicly exposed nonce can send a request to that endpoint, overwrite the victim’s password, and resultantly receive a valid logged-in cookie. This permits complete takeover of the affected account, including administrator access, without first compromising the site or other credentials. Affected systems are WordPress sites that have installed the Naimur Email OTP Verification for WooCommerce plugin, version 2.1.0 or earlier. The specific vendor product is the WooCommerce extension developed by naimurrahmannahid. No explicit patches are listed in the official CNA information, but evidence from the 2.1.1 source code suggests the flaw may have been addressed in subsequent releases. The risk score is a CVSS of 9.8, indicating critical severity. No EPSS value is available, but the lack of requirement for authenticated access and the presence of a public nonce imply a high probability of exploitation in the wild. The attack vector is remotely exploitable via HTTP(S) requests to the WordPress site’s AJAX endpoint, requiring only the victim’s email address and the nonce.

WordPress sites with the Naimur Email OTP Verification for WooCommerce plugin, version 2.1.0 or earlier. The plugin is developed by naimurrahmannahid. No additional version information is provided beyond the ≤2.1.0 cutoff.

The flaw carries a CVSS score of 9.8, classifying it as critical and indicating that attackers can easily achieve full administrative privileges on the target WordPress installation. The EPSS score is not reported, but the nature of the exploit—unauthenticated, no token, merely requiring an email and nonce—suggests that it would be readily leveraged in the real world. The flaw is not currently listed in CISA’s KEV catalog, yet the high impact warrants immediate action. The attack vector is a remote unauthenticated request to the AJAX endpoint, with no further prerequisites.