A critical authentication bypass in the Happy Coders OTP Login for WooCommerce plugin permits unauthenticated attackers to hijack any user account, including administrative accounts.

The plugin contains an authentication bypass flaw where the system fails to confirm that a valid one-time password was provided before granting access. This allows an unauthenticated attacker to log in as any existing user or create new unauthorized accounts.

With a CVSS score of 9.8, this vulnerability poses an extreme risk to e-commerce platforms using the affected plugin. An attacker gaining administrative access could exfiltrate sensitive customer data, modify store configurations, or conduct fraudulent transactions, resulting in severe financial and reputational damage.

Immediate Action: Update the Happy Coders OTP Login for WooCommerce plugin to version 2.8 or later immediately.

Proactive Monitoring: Review user account logs for anomalous logins, particularly those occurring without valid OTP challenge-response patterns.

Compensating Controls: If an immediate update is not possible, disable the OTP login functionality or restrict access to the authentication endpoints via a Web Application Firewall until a patch is applied.

Public Exploit Available: No

This vulnerability is highly critical and trivial to exploit. Store administrators must treat this as a high-priority incident and apply the provided update immediately to prevent full site takeover and unauthorized data access.