CVE-2026-104014

Summary

The Naimur Email OTP Verification for WooCommerce plugin allows unauthenticated attackers to bypass authentication and take over user accounts by reusing previously verified but incomplete password-reset requests. This occurs because the plugin stores a 'VERIFIED' state indefinitely without expiration or session binding, and lacks per-reset tokens or timestamp validation.

Exploitability

Exploitation is straightforward for attackers who know a victim's email address and can retrieve the publicly exposed nonce from the CEOVW_APP global on the WooCommerce account page; no authentication or special privileges are required.

Blast radius

Successful exploitation grants full administrative or user-level session hijacking, enabling complete site compromise if the targeted account has elevated privileges such as administrator access.

Detection

Defenders should monitor for repeated calls to wp-admin/admin-ajax.php?action=ceovw_update_new_password from the same IP with different email addresses but identical nonce values, especially when combined with prior requests to ceovw_verify_otp endpoints; additionally, inspect WordPress debug logs for unexpected password changes without corresponding login events.

Prioritized remediation

Upgrade to version 2.1.1 or later, which implements per-reset tokens, timestamp validation, and proper cleanup of verified OTP rows after successful password reset.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.