miniOrange OTP Login CVE-2026-103895

Exploitation requires three specific plugin settings on the target site: OTP-only login enabled (wp_login_skip_password=1 with wp_login_skip_password_fallback=0) AND Delay OTP Verification enabled (wp_login_delay_otp=1). Beyond configuration, exploitation is gated by a timing precondition the attacker does not control: the targeted account must currently be inside its configured Delay OTP grace interval (a recent legitimate verification must still be active). The attacker needs only knowledge of a valid username and the mo_wp_login_intent=otp request parameter with any non-empty password - no credentials, no user interaction. The limiting factors are the non-default passwordless configuration and the race-window dependency, which together explain the AC:H rating and sharply narrow the realistically exploitable population.

This is a genuine high-impact authentication bypass (CVSS 8.1, CWE-287) that yields full takeover of any WordPress account, including administrators, with complete C/I/A impact. However, the exploitability signals are mixed and should temper prioritization. The CVSS vector correctly flags AC:H because exploitation depends on multiple non-default preconditions AND a timing window outside the attacker's control. There is no public exploit identified at time of analysis and the source (Wordfence) does not indicate active exploitation; this CVE is not listed in CISA KEV and no EPSS score was provided, so widespread opportunistic exploitation cannot be asserted. The result is a serious-but-conditional flaw: catastrophic where OTP-only login with Delay OTP is enabled, but inapplicable to the majority of installs running default configurations. Treat as a priority patch for any site using miniOrange OTP-only passwordless login with the Delay OTP feature; lower urgency elsewhere. Note that PR:N confirms the attacker needs no credentials, which is the aggravating factor justifying high severity despite the configuration gate.

On a WordPress site configured for OTP-only passwordless login with Delay OTP Verification enabled, an unauthenticated attacker submits a login request for a known administrator username with the parameter mo_wp_login_intent=otp and any non-empty password. If the targeted admin recently completed OTP verification and is still inside the configured Delay OTP grace interval, the attacker inherits that grace window and is authenticated as the administrator without ever supplying valid credentials. No public exploit code is identified at time of analysis.