CVE-2026-12695: unknown miniorange 2fa Improper Authentication
Vulnerability summary
CVE-2026-12695 is a high (CVSS 8.1) Improper Authentication vulnerability in unknown miniorange 2fa. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 6.2.6.
Timeline
- 31-07-2026PublishedVulnerability first disclosed.
- 31-07-2026Last modifiedVulnerability information updated.
Description
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Affected systems
Unknown1 product
- miniorange 2fa< 6.2.6
Wordpress1 product
- miniorange-2-factor-authentication< 6.2.6
2 vendors · 2 products