WordPress WooCommerce OTP Plugin Authentication Bypass Vulnerability

The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.1.0.

The plugin's password-reset finalization endpoint authorizes the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token. The row remains in that state after a user enters their code, and a scheduled cleanup cron has no handler, so cleanup never runs.

• Affected versions: up to and including 2.1.0
• Precondition: victim previously requested and verified a password-reset code but did not finish choosing a new password
• Attacker needs only the victim's email address and a nonce localized publicly on the WooCommerce account page
• Impact: full account takeover, including administrator accounts, with a live session cookie