# naimurrahmannahid

Published articles for naimurrahmannahid.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CVE-2026-104014 - Naimur Email OTP Verification for WooCommerce \<= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

DevFeed: [CVE-2026-104014 - Naimur Email OTP Verification for WooCommerce \<= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization](<https://devfeed.tech/articles/cve-2026-104014-naimur-email-otp-verification-for-woocommerce-2-1-0-unauthenticated-authentication-bypass-to-account-takeover-via-abandoned-password-reset-finalization-122018.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-104014>)

Author: CVEFEED.io; wordfence.com

Published: 2026-11-07T11:26:33Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [password reset](<https://devfeed.tech/topics/password-reset.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [account](<https://devfeed.tech/tags/account.md>), [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [administrator](<https://devfeed.tech/tags/administrator.md>), [ajax](<https://devfeed.tech/tags/ajax.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [call](<https://devfeed.tech/tags/call.md>), [cleanup](<https://devfeed.tech/tags/cleanup.md>), [cookie](<https://devfeed.tech/tags/cookie.md>), [cron](<https://devfeed.tech/tags/cron.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-104014](<https://devfeed.tech/tags/cve-2026-104014.md>), [email](<https://devfeed.tech/tags/email.md>), [naimur-email-otp-for-woocommerce](<https://devfeed.tech/tags/naimur-email-otp-for-woocommerce.md>), [naimurrahmannahid](<https://devfeed.tech/tags/naimurrahmannahid.md>), [otp](<https://devfeed.tech/tags/otp.md>), [password](<https://devfeed.tech/tags/password.md>), [password-reset](<https://devfeed.tech/tags/password-reset.md>), [reset](<https://devfeed.tech/tags/reset.md>), [verification](<https://devfeed.tech/tags/verification.md>), [woocommerce](<https://devfeed.tech/tags/woocommerce.md>)

### AI overview

Naimur Email OTP Verification for WooCommerce versions up to and including 2.1.0 reportedly allow unauthenticated account takeover when a user verifies a password-reset code but abandons the reset. The plugin leaves the email marked "VERIFIED," and its finalization endpoint accepts that database state without checking its age, binding it to a session, or requiring a reset-specific token; the scheduled cleanup event has no registered handler. The description says an attacker needs the victim's email and a nonce publicly exposed to logged-out visitors on the WooCommerce account page. The attacker can then set a new password and receive a logged-in session cookie. Administrator accounts may enable full site takeover.

### Source excerpt

CVE ID :CVE-2026-104014 Published : Nov. 7, 2026, 11:26 a.m. | 50 minutes ago Description :The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token -- combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password -- the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overwrite the victim's password, and are returned a live wordpress_logged_in_ session cookie for that user (full site takeover if the account is an administrator). Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...