The plugin’s OTP authentication function exposes a secret magic login token in the response to a publicly accessible OTP request. This allows an unauthenticated attacker who knows a user’s e‑mail address to retrieve that token and authenticate as that user, including administrators. The flaw is a classic authentication bypass, identified as CWE‑640.

WordPress sites that have installed Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin, versions up to and including 4.8.6. Any site using these plugin versions is vulnerable.

With a Base Score of 9.8, the vulnerability is considered critical. The EPSS score is not available, but the absence of a KEV listing does not reduce the likelihood of exploitation. Attackers can trigger the flaw remotely and without prior authentication, by making an HTTP request to the OTP endpoint with the target user’s e‑mail address. Knowledge of the user’s e‑mail is the single prerequisite, after which the attacker obtains the magic token and can log in instantly.