What is the CVSS score of CVE-2026-16036?

CVE-2026-16036 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of miniOrange 2FA are affected by CVE-2026-16036?

The miniOrange 2FA WordPress plugin (versions prior to 6.2.7) contains an account takeover vulnerability allowing attackers who possess a user's password to bypass two-factor authentication and gain…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16036?

Yes, a public proof-of-concept exploit is available for CVE-2026-16036. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16036?

Within 24 hours, inventory all WordPress deployments for the miniOrange 2FA plugin and immediately disable or restrict the plugin to authorized networks on any instance running versions prior to 6.2.7. Within 7 days, upgrade all instances to miniOrange 2FA plugin version 6.2.7 or later, review administrator authentication logs for any unauthorized access attempts or successful logins dating to the plugin's installation, and reset all administrative account passwords as a precaution. Within 30 days, confirm complete patch deployment across the organization, conduct an access audit to identify any potentially compromised accounts during the vulnerability window, and evaluate alternative multi-factor authentication solutions to reduce reliance on this plugin going forward.

miniOrange 2FA CVE-2026-16036

EUVD-2026-53120 HIGH

Improper Authentication (CWE-287)

2026-08-05 WPScan

GHSA-2jhx-j965-53r6

WordPress Authentication Bypass Miniorange 2fa Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

9.1 CRITICAL

Network-accessible attack with external password prerequisite treated as AC:L condition; full account takeover yields C:H/I:H; no availability impact described anywhere in the vulnerability data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:43 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.

AnalysisAI

Account takeover in the miniOrange 2FA WordPress plugin before 6.2.7 is enabled when an attacker already possesses a target user's password - the plugin fails to bind a newly configured second factor to the target account's existing registered factor during the pre-login two-factor challenge, allowing the attacker to redirect 2FA enrollment to an attacker-controlled device, complete the challenge, and authenticate as the victim including as site administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating exploitation has not yet become widespread. Critically, the published CVSS vector (C:N/I:N/A:H) severely misrepresents the actual impact - this is a full account-takeover flaw with high confidentiality and integrity consequences, not a denial-of-service; analysts should not use the published vector for risk calibration.

Technical ContextAI

The vulnerability resides in the miniOrange 2FA WordPress plugin (CPE: cpe:2.3:a:unknown:miniorange_2fa:*:*:*:*:*:*:*:*; vendor field unresolved in NVD) and is classified under CWE-287 (Improper Authentication). The root cause is a missing cryptographic or session-level binding between the second-factor enrollment or reconfiguration request and the already-registered factor for the account being authenticated. During the pre-login 2FA challenge - a state where the user has supplied a valid password but has not yet completed MFA - the plugin accepts a new factor configuration without validating that it corresponds to the account's existing registered factor. This breaks the security invariant that only the legitimate account owner (who controls the registered device or channel) can satisfy the second factor, effectively converting the MFA system into a single-factor one that can be hijacked by anyone holding the password.

RemediationAI

Update the miniOrange 2FA WordPress plugin to version 6.2.7 or later immediately; this is the vendor-confirmed patched release that corrects the factor binding logic during the pre-login challenge. The WPScan advisory at https://wpscan.com/vulnerability/cffa0566-7fcc-40f0-9e4c-f1c3abaa5eb0/ and EUVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-16036 should be consulted for additional vendor guidance. If immediate patching is not possible, consider temporarily disabling the miniOrange 2FA plugin and enforcing access to the WordPress admin panel through network-layer controls such as IP allowlisting or VPN-only access - note that disabling MFA trades the rebinding risk for reduced authentication assurance, and this trade-off should be assessed against the site's threat model. Following any remediation, review all WordPress accounts for unexpected 2FA configuration changes as a potential indicator of prior exploitation, and audit accounts with administrator roles for signs of unauthorized access.