Critical Auth Bypass in Naimur Email OTP Verification for WooCommerce Enables Account Takeover (CVE-2026-104014)

A flawed password-reset endpoint in the Naimur Email OTP Verification for WooCommerce plugin, versions 2.1.0 and earlier, can let an unauthenticated attacker take over a WordPress account. The account is exposed only if its owner verified a password-reset code and then didn't finish the reset. If that account is an administrator, the attacker gets full control of the site.

What Is It

CVE-2026-104014 is an authentication bypass (CWE-287) in the plugin's password-reset finalization endpoint, the wp_ajax_nopriv_ceovw_update_new_password AJAX action handled by CEOVW_AJAX::update_new_password(). The endpoint allows a reset if a database row marks an email as VERIFIED. It does not check a timestamp, bind the reset to a session, or require a per-reset token.

Three other flaws make this worse:

• mark_otp_as_verified_for_reset() leaves the row in the VERIFIED state after a user enters their code. If the user abandons the flow, the row stays.
• The scheduled ceovw_cleanup_expired_otps_event cron has no add_action() handler anywhere in the plugin, so cleanup never runs.
• The required nonce is published by the plugin itself in the CEOVW_APP global on the WooCommerce account page for logged-out visitors.

If a VERIFIED row is left over for the victim's email, the attacker needs only that email address and the public nonce. They call the endpoint, overwrite the victim's password, and get back a live wordpress_logged_in_ session cookie for that user. Accounts with no leftover verified row can't be attacked this way.

Why It Matters

Wordfence rates the flaw 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is exploitable over the network with low complexity, and needs no privileges and no user interaction. Any account whose owner requested and verified a reset code, then didn't finish choosing a new password, is exposed. Because cleanup never runs, those leftover rows stay exploitable indefinitely. Taking over an administrator account means taking over the whole site.

This CVE has no CISA KEV entry, so the supplied data does not confirm active exploitation.

What's Vulnerable

• Vendor: naimurrahmannahid
• Product: Naimur Email OTP Verification for WooCommerce (WordPress plugin)
• Affected versions: all versions up to and including 2.1.0

The NVD record status is "Deferred." It was published 2026-11-07.

Patch Status

The record lists versions through 2.1.0 as affected, and its references include the plugin's 2.1.1 tag. That points to 2.1.1 as the updated release, but the supplied data does not explicitly confirm a fix. Site owners should:

• Update to the latest release (2.1.1 or later) and check the vendor and Wordfence advisories.
• If updating isn't possible, deactivate the plugin.

CISA has issued no required action because the CVE is not in the KEV catalog.

Sources

• NVD, CVE-2026-104014
• Wordfence Threat Intel advisory
• WordPress Plugin Trac; class-ajax.php (2.1.0, L10)
• WordPress Plugin Trac; class-ajax.php (2.1.0, L163)
• WordPress Plugin Trac; class-security.php (2.1.0, L72)
• WordPress Plugin Trac; class-security.php (2.1.0, L77)
• WordPress Plugin Trac; main plugin file (2.1.0, L38)
• WordPress Plugin Trac; class-ajax.php (2.1.1)