EUVD-2026-42543
GHSA-26hr-8h4j-gxx3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, single-request admin takeover using a public nonce with no role check justifies AV:N/AC:L/PR:N/UI:N and full C/I/A High; the config prerequisite is not a CVSS base metric.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the um_reset_password_process_hook() function performing no server-side verification that the OTP validation step was completed, and relying solely on a public form_nonce nonce that the plugin itself emits to unauthenticated visitors via the moumprvar JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled username_b parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account - returned in a 302 Location header - and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.1) lets unauthenticated attackers take over any Administrator account. Because um_reset_password_process_hook() never verifies server-side that the OTP step was completed and trusts a form_nonce that the plugin itself hands to anonymous visitors via the moumprvar JavaScript object, an attacker can supply an arbitrary username_b value to receive a fresh password-reset URL for any user in the 302 Location header. No public exploit identified at time of analysis, but the flaw is trivially scriptable and carries a critical 9.8 CVSS score.
Technical ContextAI
The flaw sits in the Ultimate Member password-reset integration of the miniOrange OTP plugin (class-moumpasswordreset.php). The plugin emits form_nonce into the moumprvar JavaScript object on the public Ultimate Member reset page, so the nonce is not a secret and is readable by any unauthenticated visitor. WordPress nonces are CSRF replay tokens, not authorization controls, so relying on one to gate a password reset is the textbook CWE-862 (Missing Authorization) root cause. The reset handler accepts an attacker-controlled username_b parameter and issues a valid reset key without confirming the prior OTP validation succeeded or that any OTP session is bound to the target user, collapsing the intended multi-factor reset flow into a single unauthenticated request. The affected package is identified by CPE cpe:2.3:a:cyberlord92:miniorange_otp_login,_verification_and_sms_notifications.
RemediationAI
Upgrade the plugin to the fixed release published after 5.5.1; an upstream fix is available (see the plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3595061%40miniorange-otp-verification&new=3595061%40miniorange-otp-verification), but the exact patched version number was not included in the source data, so confirm the release via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d34f4e77-f384-4d84-be32-0d349962b614?source=cve before deploying. If immediate patching is not possible, disable the Ultimate Member Password Reset Form integration (removes the vulnerable path but breaks OTP-based password reset for legitimate users), or switch the plugin to phone-only reset mode, which the description states is unaffected (trade-off: users without a registered phone lose reset ability). As a network control, place the Ultimate Member reset endpoint behind IP allowlisting or a WAF rule blocking unauthenticated requests that carry the username_b parameter, and audit Administrator accounts for unexpected password changes.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today