miniOrange OTP Verification CVE-2026-106610

Exploitation requires a WordPress installation with the miniOrange OTP Verification plugin (miniorange-otp-verification) at any version from initial release through 5.5.7 installed and active. The flaw is an incorrect privilege assignment allowing privilege escalation (CWE-266); the supplied CVSS vector marks it AV:N/PR:N/UI:N, implying no authentication or user interaction against an affected install, but because the weakness is a privilege-escalation class issue a low-privileged authenticated account may in fact be the realistic precondition - this authentication prerequisite is not confirmed from the available data and limits exploitation if present. The primary limiting factor is simply running an unpatched version of this specific plugin.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes a remote, unauthenticated, low-complexity privilege-escalation flaw with full confidentiality, integrity, and availability impact. However, the underlying weakness (CWE-266 Incorrect Privilege Assignment leading to 'Privilege Escalation') is somewhat at odds with PR:N: privilege-escalation issues frequently require an existing low-privileged foothold, so the PR:N rating from Patchstack should be verified - if exploitation actually needs an authenticated low-privileged account, real-world risk is meaningfully lower than 9.8 implies. On exploitation signals, no EPSS score, no CISA KEV listing, and no public POC were supplied, so there is currently 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net: this is a high-severity-on-paper WordPress plugin flaw from a reputable reporter (Patchstack), but the absence of any exploitation evidence (EPSS/KEV/POC) and the PR:N/privilege-escalation tension mean it should be treated as a prompt-patch item rather than an active-exploitation emergency - verify the true authentication prerequisite with the vendor/Patchstack advisory before final prioritization.

A remote attacker targets a WordPress site running miniOrange OTP Verification ≤ 5.5.7 and abuses the plugin's incorrect privilege assignment to obtain privileges beyond what their account should hold, potentially reaching administrative capability. Per the CVSS vector this requires no user interaction and no authentication, though the CWE-266 privilege-escalation nature suggests a low-privileged account may in practice be involved. No public proof-of-concept was provided in the source data.