CVE-2023-2706: The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via pho

high Affects mobile-login-woocommerce (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2023-05-17; advisory modified 2026-06-17.

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via pho

Package: mobile-login-woocommerce (WordPress plugin) WordPress
Affected versions: <2.3
Fixed in: 2.3
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 2% (77.4th percentile)
Published: 2023-05-17
Source: nvd

References

CWE-287

NVD record mobile-login-woocommerce (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-32648 KEV high Account Takeover in Octobercms same weakness: CWE-287
CVE-2018-12613 high phpMyAdmin Improper Authentication same weakness: CWE-287
CVE-2018-3810 critical Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before same weakness: CWE-287
CVE-2023-28121 critical An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an same weakness: CWE-287
CVE-2014-4725 high The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows rem same weakness: CWE-287
CVE-2020-8771 critical The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any req same weakness: CWE-287