miniOrange 2FA CVE-2026-16035

Exploitation requires a valid low-privileged WordPress account - at minimum subscriber level - on a site running the miniOrange 2FA plugin before version 6.2.7. The vulnerability is reachable over the network with no user interaction from a victim. The OTP quota exhaustion impact is only significant when the site relies on a metered OTP delivery service (e.g., a paid SMS or email API with a capped allowance); sites with unlimited OTP delivery capacity experience only the unauthorized email send aspect. Exploitation does not require admin access, plugin configuration control, or any non-default WordPress setup beyond having the miniOrange 2FA plugin installed and active.

The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) scores 4.3, which accurately reflects the constrained impact: no confidentiality or integrity loss, and only low availability impact. EPSS at 0.13% (3rd percentile) aligns with this modest severity - the vulnerability is not being observed in widespread exploitation. No CISA KEV listing further supports that this has not been leveraged in notable incidents. However, a public POC published by WPScan does lower the exploitation barrier for opportunistic actors. The primary real-world risk is twofold: first, spam or harassment via unsolicited OTP email delivery to arbitrary targets (reputational and compliance risk for the WordPress site operator); second, quota exhaustion on metered OTP services, which could block all legitimate users from completing 2FA login - a meaningful operational disruption for high-security WordPress deployments that enforce 2FA. This is a real priority for sites using paid, quota-limited OTP services, but lower urgency for those with unlimited delivery capacity. The missing-integrity signal (unauthorized email send) is understated in the official I:N rating.

An attacker with any low-privileged WordPress account (e.g., subscriber or contributor) identifies the OTP send endpoint used during 2FA enrollment. Using the publicly available POC documented by WPScan, the attacker submits repeated OTP trigger requests specifying a target email address they do not own, causing the site to send that address a stream of OTP codes and simultaneously consuming the site's metered OTP quota, ultimately preventing all legitimate users from receiving their 2FA codes until the quota resets.