What is the CVSS score of CVE-2026-16035?

CVE-2026-16035 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16035?

Yes, a public proof-of-concept exploit is available for CVE-2026-16035. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16035?

Yes, a patch is available for CVE-2026-16035. Update the affected software to the latest version immediately.

miniOrange 2FA CVE-2026-16035

EUVD-2026-52591 MEDIUM

Missing Authorization (CWE-862)

2026-08-04 WPScan

GHSA-pq9j-g4gw-q76g

WordPress Authentication Bypass Miniorange 2fa Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects required low-privileged account; I:L added because unauthorized OTP emails to arbitrary recipients represent an unauthorized data transmission beyond the official I:N rating.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:30 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

AnalysisAI

Missing authorization in the miniOrange 2FA WordPress plugin before 6.2.7 allows any authenticated low-privileged user to trigger OTP email delivery to arbitrary email addresses and exhaust the site's metered OTP quota. The plugin's second-factor enrollment endpoint neither restricts which users may invoke it nor binds the OTP recipient to the enrolling user's own address, enabling both unsolicited OTP email delivery and a denial-of-service attack against other users' 2FA flows. No public exploitation or KEV listing has been identified, though a public proof-of-concept is available via WPScan; EPSS stands at 0.13% (3rd percentile), indicating low observed exploitation activity.

Technical ContextAI

The affected component is the miniOrange 2FA WordPress plugin (CPE: cpe:2.3:a:unknown:miniorange_2fa:*:*:*:*:*:*:*:*), a two-factor authentication plugin for WordPress that supports OTP delivery via email and likely SMS through metered third-party services. The root cause is CWE-862 (Missing Authorization): the endpoint responsible for dispatching OTP codes during the 2FA enrollment or configuration flow performs no server-side check to confirm that the authenticated requester is allowed to trigger an OTP send, and critically, does not validate that the supplied recipient address matches the requesting user's own registered address. This architectural gap violates the principle that OTP generation and delivery should be tightly bound to the authenticated session of the specific user being enrolled, making the functionality exploitable by any account that can reach the endpoint.

RemediationAI

Update the miniOrange 2FA WordPress plugin to version 6.2.7 or later, which is the vendor-released patch as confirmed by WPScan (https://wpscan.com/vulnerability/26217efe-b867-4bb9-ac7c-765fb796e2c1/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-16035). WordPress site administrators can apply the update directly from the WordPress plugin dashboard. If immediate patching is not possible, a meaningful compensating control is to restrict access to the 2FA enrollment endpoint via a web application firewall rule that limits OTP send requests to a strict per-user rate (e.g., three requests per hour per authenticated session), reducing the quota exhaustion risk; note this does not fix the recipient-binding flaw. Additionally, if the metered OTP service supports IP-based or account-level rate limiting on the provider side, enabling that adds a second layer of protection. Removing the plugin entirely until patching is feasible is the most conservative option and eliminates both attack surfaces.