Naimur Email OTP Verification for WooCommerce

Naimur Email OTP Verification for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Improper Authentication, behind 1 of the records (100%).

The one issue recorded for Naimur Email OTP Verification for WooCommerce has a vendor fix available, so running the current release closes it.

All of these findings were reported by s4m0y3d. Naimur Email OTP Verification for WooCommerce is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSCritical
9.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Naimur Email OTP Verification for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-104014

Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

Read the full analysis

Vulnerability Records

1 records
Naimur Email OTP Verification for WooCommerce banner
Latestv2.1.2

Naimur Email OTP Verification for WooCommerce

Naimur Rahman Nahid

Author

Naimur Rahman Nahid

5.0(3)
100/100
Last Updated
2026-11-02 (5d ago)
Active Installs
40+
Downloads
1,416
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1.4
Created
2025-11-15 (1y ago)
Requires Plugins
woocommerce

Naimur Email OTP Verification for WooCommerce confirms that a customer really owns their email address. A one-time code (OTP) is emailed and must be entered before the action completes. The OTP is used for: New customer registration Password reset (Forgot Password) Checkout (optional, off by default): the order is placed only after the billing email is verified The plugin does not add OTP to login. Key features 6-digit email OTP for WooCommerce customer registration OTP-based Forgot Password flow with a single-use, short-lived reset authorization (no automatic login after a reset) Optional checkout email verification for the Checkout block and the classic checkout, for guests and (optionally) logged-in customers. Verification is enforced on the server before the order is created, so no payment is taken from an unverified checkout Accessible verification popup at checkout: 6-digit input with paste support, countdown, resend with cooldown, change email, mobile bottom-sheet layout Three responsive email templates (registration, password reset, checkout) that use your store logo, name and brand colour HTML template editor with syntax highlighting, placeholders, a sandboxed live preview (desktop and mobile) and test emails “Naimur OTP” admin area: overview with setup checklist, one Verification page with Registration, Password Reset and Checkout tabs, email templates, security limits, branding, activity and diagnostics, searchable help and a settings finder Server-side protection: hashed codes, attempt limits, expiry, single use, per-IP and per-email rate limits, purpose and session binding Compatible with WooCommerce High-Performance Order Storage (HPOS) and the Cart and Checkout blocks Translation-ready, with developer filters such as ceovw_otp_expiry, ceovw_checkout_auth_ttl, ceovw_rate_limit and ceovw_client_ip How it works Registration: the customer fills in the registration form and receives a 6-digit code by email. The account is created only after the correct code is entered. Password reset: the customer requests a code, verifies it and sets a new password, then signs in with it. Checkout (when enabled): after clicking Place order, a popup asks for the code sent to the billing email. Once verified, the order is placed automatically. Changing the email requires a new code. Documentation Built-in documentation is available under Naimur OTP → Help & Documentation. More guides: https://naimurrahmannahid.com/naimur-otp-plugin/ Video tutorial: Source code The JavaScript file assets/js/main.js is a compiled/optimized build used in production. A human-readable source version of this script is bundled with the plugin under: assets/src/js/main.js All other JavaScript and CSS files (assets/js/checkout-otp.js, assets/admin/admin.js and the stylesheets) are shipped unminified.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C