miniOrange 2FA CVE-2026-111949

Exploitation requires that the attacker already knows the victim's WordPress account password AND that the targeted account already has a passkey configured in miniOrange 2FA - the flaw is that a login left in the 'pending passkey' state is permitted to register an additional, attacker-controlled passkey instead of being blocked. Limiting factors: the attacker must possess valid primary credentials (PR:L), must interact during the pending-login window which introduces a timing/state dependency (reflected as AC:H), and the installed plugin version must be between 6.2.9 and 6.3.1. No victim user interaction is required (UI:N). This is not a condition reachable against a fully unauthenticated attacker.

This is a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) correctly captures the two realities that temper the 7.5 base score: the attacker must already hold the victim's password (PR:L), and exploitation depends on hitting a specific 'pending passkey login' state (AC:H). Publicly available exploit code exists (reported by WPScan), which raises practical risk, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation at this time - treat this as 'exploit available, exploitation unconfirmed.' The signals are internally consistent (network-reachable WordPress plugin, credential-dependent auth bypass), with no contradiction between the vector and the description. The real-world gating factor is credential compromise: this is an authentication (2FA) bypass that assumes the primary factor is already defeated, so it is most relevant where password reuse, phishing, or prior breaches are in play rather than as a standalone remote-takeover bug.

An attacker who has already obtained a target WordPress user's password (via phishing, reuse, or a prior leak) initiates a login and, while the session is in the pending-passkey state, registers their own authenticator on the account despite an existing passkey being configured. On the next login the attacker satisfies the second factor with their own passkey, fully bypassing 2FA and taking over the account. Public exploit code for this flaw is available via WPScan, lowering the effort required.