The OTP Login & Register WooCommerce plugin fails to enforce a proper limit on one‑time‑password verification attempts. The counter used for this limit is supplied by the client and can be freely manipulated, allowing an attacker to reset it and bypass the restriction. By repeatedly attempting the short numeric login code, an unauthenticated attacker can brute‑force the OTP and gain access to any registered user account without knowing its password, effectively taking over the account and all associated data and capabilities.

WordPress sites that rely on the OTP Login & Register WooCommerce plugin with a version older than 2.7.3 are affected. Any installation where the plugin is active and the OTP login feature is enabled is vulnerable, regardless of whether WooCommerce or other plugins are also present.

The CVSS score of 7.4 indicates a high severity, and the EPSS score of less than 1% shows a low but non‑zero likelihood of exploitation. The vulnerability can be exploited without prior authentication by sending web requests to the OTP validation endpoint, a public interface. Although the flaw is not listed in the CISA KEV catalog, the potential for mass account takeover makes it a significant risk for affected sites.