CVE-2026-84110 Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security
Attackers can bypass OTP validation in the Releasit COD Form & Upsells plugin by exploiting client-side enforcement of server-side security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84110?
CVE-2026-84110 is a medium-severity vulnerability in Releasit COD Form & Upsells, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version v2 is able to resolve this issue. The affected component should be upgraded.
Weakness: CWE-602
Which versions are affected by CVE-2026-84110?
How do I fix CVE-2026-84110?
No fix has been published for CVE-2026-84110 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84110 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84110 exists.
Sources
Also known as GHSA-5wc2-mmff-3rxq.