A critical vulnerability in a WordPress plugin for WooCommerce lets an attacker take over user accounts without logging in, and no fix is available yet. The flaw, tracked as CVE-2026-104014, was published on 7 November 2026 and carries a CVSS score of 9.8 out of 10.

The affected software is Naimur Email OTP Verification for WooCommerce, versions up to and including 2.1.0, which checks customer email addresses with a one-time code. The weakness sits in the plugin's password-reset process. When a user requests a reset code and verifies it but does not finish choosing a new password, the plugin leaves a database row marking that email address as verified, with no timestamp check, no session binding and no per-reset token.

An attacker needs only the victim's email address and a nonce that the plugin itself exposes publicly to logged-out visitors on the WooCommerce account page. Calling the plugin's password-update endpoint then lets the attacker overwrite the victim's password and receive a live logged-in session cookie for that account. If the account belongs to an administrator, that means full control of the site.

The flaw is worsened by a broken clean-up routine: a scheduled task meant to delete expired one-time codes has no handler anywhere in the plugin, so the stale verified rows are never removed. CISA's assessment rates the flaw as automatable with total technical impact, although it records no known exploitation and the flaw is not in CISA's Known Exploited Vulnerabilities catalogue. No public exploit code is tracked.

Until a patched version appears, site owners using the plugin should consider disabling it or restricting access to the password-reset endpoint, and should check whether any accounts show password changes they did not make.