Link Invoice Payment for WooCommerce 2.13.2 email OTP account takeover

BugShield Scout discovered missing verification attempt limits in the email one-time password (OTP) login feature of Link Invoice Payment for WooCommerce 2.13.2. When email OTP is enabled, unauthenticated visitors can access the OTP sending and verification REST routes. The six-digit code remains valid for the configured period of 1 to 60 minutes, and the affected verification function does not count or limit failed guesses. A successful guess authenticates the visitor as the account associated with the email address. This can allow account takeover, including an administrator account where the configured login mode permits it. The routes reject requests when email OTP is disabled. The affected code is in Includes/WcPaymentInvoiceOtpEmail.php. BugShield privately reported the issue to Link Nacional on 19 October 2026. The developer confirmed the report and stated that a fix first shipped in 2.13.3. That release was not available for independent source inspection. BugShield reviewed the publicly available 2.14.0 source, which contains a five-attempt limit per code, code invalidation and a 15-minute email lockout after the fifth failed attempt, single-use codes, replacement of the previous code on resend, HMAC-hashed code storage and hash_equals() comparison. It also adds a 60-second resend delay, sending limits of 10 per email and 20 per IP per hour, and a limit of 30 verification failures per IP per 15 minutes. The 2.14.0 changelog records the OTP security fix. The developer reports 57 passing integration tests; BugShield has reviewed the released source but has not independently repeated those tests or a functional exploit retest. The confirmed affected version is 2.13.2; earlier versions were not assessed for this advisory. High is BugShield's qualitative severity assessment; no CVE or numerical CVSS score is assigned.

Discovered by BugShield Scout. Published by BugShield.