Client-Side OTP Rate Limit Bypass in WordPress Plugin

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The OTP Login & Register WooCommerce plugin contains a critical authentication weakness where one-time password (OTP) verification attempts are tracked using a client-controlled value rather than server-side session state. This allows attackers to reset the attempt counter by simply modifying their supplied value, enabling unlimited brute-force attacks against short numeric login codes. Organizations using this plugin before version 2.7.3 face direct account takeover risk, as attackers can systematically guess OTP codes without triggering rate-limiting protections. Any WooCommerce site relying on this plugin for customer authentication is potentially compromised, particularly those with high-value accounts or sensitive customer data.

Casky's 283 matching skills detect the attack patterns associated with this vulnerability across MITRE ATT&CK's Credential Access (TA0004) and Credential Dumping (TA0006) techniques. Practitioners using Casky would identify indicators including: repeated failed OTP submission attempts from single IP addresses that show no backoff behavior, abnormal patterns of successful authentications following brute-force activity, and client requests containing manipulated rate-limit tracking parameters. Claude's extended reasoning capability maps these observable patterns to the underlying CWE-287 (Improper Authentication) flaw, helping security teams distinguish legitimate login failures from coordinated account takeover attempts. The platform's skill correlation would surface related defensive controls—such as server-side attempt tracking, exponential backoff implementation, and account lockout policies—enabling practitioners to both detect active exploitation and remediate the root cause before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110135.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-110135

Casky has 283 skills that investigate the attack patterns behind CVE-2026-110135. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn