vulnerability
WordPress Plugin: mobile-login-woocommerce: CVE-2023-2706: Improper Authentication
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:H/Au:N/C:C/I:C/A:C) | May 16, 2023 | May 15, 2025 | May 15, 2025 |
Severity
8
CVSS
(AV:N/AC:H/Au:N/C:C/I:C/A:C)
Published
May 16, 2023
Added
May 15, 2025
Modified
May 15, 2025
Description
The OTP Login Woocommerce and Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
Solution
mobile-login-woocommerce-plugin-cve-2023-2706
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.