CVE-2026-104014

Description

The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator).

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: CRITICAL
CVSS score: 9.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Effective score: 9.8 / 10 CRITICAL source: CNA overview
CWE(s): CWE-287
Reserved: 2026-10-01
Published: 2026-11-07 11:26 UTC
Last updated: 2026-11-07 18:26 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104014.json
Linked Threat: CVE-2026-104014 — Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

Affected products (1)

Vendor	Product	Versions	Platforms
naimurrahmannahid	Naimur Email OTP Verification for WooCommerce	`0` (affected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-104014`	no local data	2026-11-07 00:25 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft Patch Tuesday, October 2026 Security Update Review

web:blog.qualys.com

Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape…

2026-11-07 00:25 UTC
Pennsylvania Access To Criminal History - Home - pa

web:epatch.pa.gov

Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

2026-11-07 00:25 UTC
Microsoft Paint CVE-2026-83844: fix confirmed and affected versions ...

web:rootaccessguy.com

Microsoft confirms Paint 11.2609.401. fixes CVE - 2026 -83844 and now includes builds below that threshold in the affected range. Verify the app build separately from Windows Update.

2026-11-07 00:25 UTC
ArcGIS Server Security 2026 Update 4 Patch - Esri Support

web:support.esri.com

The issues resolved by these patches are listed in the Issues addressed with this patch section below. As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and ...

2026-11-07 00:25 UTC
Microsoft Patch Tuesday November 2026: 0 CVEs | Trinetri

web:trinetriops.com

Microsoft's November 2026 Patch Tuesday fixes 0 vulnerabilities across Microsoft products. Full CVE list with severity, CVSS, affected components and KB numbers, plus what to deploy first.

2026-11-07 00:25 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-11-07 00:25 UTC
Home - PATCH Hawaii

web:www.patchhawaii.org

PATCH provides access to registered and licensed child care, offers child care subsidies to eligible families, provides child development training and ECE scholarship opportunities, and assists those interested in starting a family child care business. PATCH is a free resource hub for families, child care professionals and communities of Hawaii.

2026-11-07 00:25 UTC
October 2026 Patch Tuesday: The Critical Flaws You CANNOT Ignore

web:www.thetechedvocate.org

Spread the loveAlright, let's cut straight to it. The latest October 2026 Patch Tuesday has dropped, and frankly, it's a doozy. We're talking about an absolutely staggering 1,413 vulnerabilities uncovered across Microsoft's ecosystem. If that number alone doesn't make your eyebrows shoot up, consider this: among them are three actively exploited zero-day vulnerabilities and a truly ...

2026-11-07 00:25 UTC
Wordfence remediation: Naimur Email OTP Verification for WooCommerce

Wordfence

Update to version 2.1.1, or a newer patched version

2026-11-07 00:25 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-104014.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:18.295742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Naimur Email OTP Verification for WooCommerce",
          "vendor": "naimurrahmannahid",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "s4m0y3d"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token \u2014 combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password \u2014 the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:33.449Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b29918de-22a2-424f-ad86-ad83874ca81a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L163"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L77"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-security.php#L72"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/includes/class-ajax.php#L10"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.0/naimur-email-otp-for-woocommerce.php#L38"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/naimur-email-otp-for-woocommerce/tags/2.1.1/includes/class-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T08:07:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:32:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104014",
    "datePublished": "2026-11-07T11:26:33.449Z",
    "dateReserved": "2026-10-01T16:43:39.527Z",
    "dateUpdated": "2026-11-07T18:26:30.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}