Search

Find a vulnerability

Search criteria

    2 vulnerabilities by naimurrahmannahid

    CVE-2026-104014 (GCVE-0-2026-104014)

    Vulnerability from nvd – Published: 2026-11-07 11:26 – Updated: 2026-11-07 18:26
    VLAI
    Title
    Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization
    Summary
    The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator).
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-07 18:11 UTC
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2480 records in the last 180 days details
    References
    Impacted products
    Credits
    s4m0y3d
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:18.295742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Naimur Email OTP Verification for WooCommerce",
          "vendor": "naimurrahmannahid",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "s4m0y3d"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin\u0027s password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as \u0027VERIFIED\u0027, with no timestamp check, no session binding, and no per-reset token \u2014 combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled \u0027ceovw_cleanup_expired_otps_event\u0027 cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password \u2014 the attacker needs only the victim\u0027s email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim\u0027s password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:33.449Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b29918de-22a2-424f-ad86-ad83874ca81a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L163"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L77"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L72"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L10"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/naimur-email-otp-for-woocommerce.php#L38"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.1/includes/class-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T08:07:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:32:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Naimur Email OTP Verification for WooCommerce \u003c= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104014",
    "datePublished": "2026-11-07T11:26:33.449Z",
    "dateReserved": "2026-10-01T16:43:39.527Z",
    "dateUpdated": "2026-11-07T18:26:30.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-104014 (GCVE-0-2026-104014)

    Vulnerability from cvelistv5 – Published: 2026-11-07 11:26 – Updated: 2026-11-07 18:26
    VLAI
    Title
    Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization
    Summary
    The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator).
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-07 18:11 UTC
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2480 records in the last 180 days details
    References
    Impacted products
    Credits
    s4m0y3d
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:18.295742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Naimur Email OTP Verification for WooCommerce",
          "vendor": "naimurrahmannahid",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "s4m0y3d"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin\u0027s password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as \u0027VERIFIED\u0027, with no timestamp check, no session binding, and no per-reset token \u2014 combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled \u0027ceovw_cleanup_expired_otps_event\u0027 cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password \u2014 the attacker needs only the victim\u0027s email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim\u0027s password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:33.449Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b29918de-22a2-424f-ad86-ad83874ca81a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L163"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L77"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L72"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L10"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/naimur-email-otp-for-woocommerce.php#L38"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.1/includes/class-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T08:07:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:32:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Naimur Email OTP Verification for WooCommerce \u003c= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104014",
    "datePublished": "2026-11-07T11:26:33.449Z",
    "dateReserved": "2026-10-01T16:43:39.527Z",
    "dateUpdated": "2026-11-07T18:26:30.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}