CVE-2026-77264

The record

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.

Affected packages

Related vulnerabilities

• CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login… CWE-640
• CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. CWE-640
• CVE-2026-58202 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-640
• CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-640
• CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-640
• CVE-2026-86055 Part-DB is an open source inventory management system for electronic components. CWE-640
• CVE-2026-81905 Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes… CWE-640
• CVE-2026-71625 An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges… CWE-640