Unknown Miniorange 2FA vulnerabilities
7 vulnerabilities
Known vulnerabilities in Unknown Miniorange 2FA, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2026-111949unknown · miniorange 2faminiOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor RebindingThe miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.EPSS0.22%HighCVE-2026-16036unknown · miniorange 2fa +1 moreminiOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor RebindingThe miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.EPSS0.43%MediumCVE-2026-16035unknown · miniorange 2fa +1 moreminiOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP SendThe miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.EPSS0.33%HighCVE-2026-16619unknown · miniorange 2fa +1 moreminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsThe miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.EPSS0.32%CriticalCVE-2026-77770unknown · miniorange 2fa +1 moreminiOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link ValidatorThe miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.EPSS0.44%HighCVE-2026-77771unknown · miniorange 2fa +1 moreminiOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP LockoutThe miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.EPSS0.32%HighCVE-2026-12695unknown · miniorange 2fa +1 moreminiOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secretThe miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.EPSS0.29%