EUVD-2026-54204
GHSA-m749-g32x-9hgv
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:N and AC:H reflect network-reachable attack requiring prior credential possession; PR:L captures the password prerequisite; full triad impact models complete account takeover.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
AnalysisAI
Unlimited OTP brute-force in the miniOrange 2FA WordPress plugin before 6.2.8 allows a network attacker who already possesses a target user's password to bypass two-factor authentication entirely and achieve full account takeover. The flaw lies in rate-limit tracking being anchored to a client-supplied identifier that is reissued on every login attempt, meaning the attempt counter resets on demand and never accumulates. No public exploit has been identified at time of analysis, and the plugin is not listed in CISA KEV; however, the impact is total authentication bypass for any account protected by the plugin.
Technical ContextAI
The miniOrange 2FA WordPress plugin implements a second authentication factor - typically a time-based one-time password (TOTP) or similar code - as a post-credential-verification step during WordPress login. Standard security practice requires server-side rate limiting or lockout tied to a persistent, server-generated session or user identifier so that repeated wrong guesses trigger throttling or lockout. This implementation instead tracks failed attempts against a client-supplied identifier. Because that identifier is reissued on each new login initiation, an attacker can reset the attempt counter at will by simply re-initiating the login flow, rendering any configured lockout policy ineffective. The root cause aligns with CWE-307 (Improper Restriction of Excessive Authentication Attempts), though NVD has not formally assigned a CWE. The affected versions are all releases of the plugin prior to 6.2.8, as confirmed by WPScan advisory 54fc1229-3e68-4d21-baec-59a44cf12a65.
RemediationAI
Update the miniOrange 2FA WordPress plugin to version 6.2.8 or later, which corrects the attempt-tracking logic to use a server-side, user-bound identifier rather than a client-supplied one. The fix is documented via WPScan at https://wpscan.com/vulnerability/54fc1229-3e68-4d21-baec-59a44cf12a65/. If immediate patching is not possible, a targeted workaround is to use a web application firewall rule to enforce per-IP or per-user-session rate limiting on the WordPress 2FA verification endpoint, blocking or throttling requests that exceed a threshold (e.g., 5-10 attempts) within a short window; note this approach may block legitimate users on shared IPs. Additionally, enforcing strong, unique passwords and monitoring for repeated login events in WordPress audit logs can reduce the likelihood that the prerequisite credential compromise has occurred.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today