EUVD-2026-57972
GHSA-56v2-rm7h-g26f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public WordPress OTP endpoint
-
DeliverySubmit forged verification request
-
ExploitBypass weak OTP check
-
ExecutionRegister or elevate to privileged account
-
ImpactGain administrative control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password recovery security
|
| Exploitation Conditions | The affected site must be running the miniOrange OTP Verification WordPress plugin at version 5.5.1 or earlier with its OTP verification flow reachable by anonymous users (typically registration, login, or recovery forms). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special deployment mode are required for exploitation against a vulnerable installation. The primary limiting factor is simply having the plugin installed, active, and exposing the OTP-gated flow; sites that do not use the affected verification endpoints or have the plugin disabled are not exposed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) describes the worst-case profile: remote, low-complexity, unauthenticated, no user interaction, with full impact - consistent with the 'Unauthenticated Privilege Escalation' description. However, key corroborating signals are missing: no EPSS probability was supplied, the CVE is not in CISA KEV, and no POC is referenced, so real-world exploitation likelihood cannot be quantified from the input. This means the score reflects potential severity rather than confirmed active-exploitation risk. Given the plugin's role in authentication and the trivially-remote vector, defenders should treat it as a genuine priority despite the absence of EPSS/KEV corroboration, while recognizing that the exploitation-in-the-wild status is currently unknown. |
| Exploit ScenarioDerived | An unauthenticated attacker reaches a WordPress site running the miniOrange OTP Verification plugin (<= 5.5.1) and abuses the weak OTP verification logic to satisfy or bypass the identity check, registering or authenticating as a privileged account. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, victim interaction, or complex conditions are required. No public POC is referenced at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.
RemediationAI
Upgrade the miniOrange OTP Verification plugin to a release newer than 5.5.1 as soon as the vendor publishes it; the affected range is <= 5.5.1 but the exact patched version is not confirmed in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-5-5-1-privilege-escalation-vulnerability) and the plugin's WordPress.org changelog to confirm the fixed build. If an update is not yet available, compensating controls include temporarily deactivating the OTP Verification plugin (trade-off: removes OTP-based verification from registration/login flows), restricting access to the affected verification/registration endpoints via WAF or web-server rules, and disabling open user registration in WordPress settings to limit who can trigger the flow. Monitor for unexpected new administrator or elevated-privilege accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the miniOrange OTP Verification plugin for WordPress, which adds one-time-password verification to registration, login, and form flows (CPE cpe:2.3:a:miniorange:miniorange_otp_verification). The assigned CWE-640 (Weak Password Recovery / Verification Mechanism for Forgotten Password) indicates the root cause lies in how the plugin validates OTP-based identity or recovery challenges - for example predictable, reusable, or improperly enforced OTP checks that an attacker can satisfy or bypass. Because OTP verification gates account creation and authentication in WordPress, a weakness here can be leveraged to register or authenticate as a higher-privileged account, translating a verification bypass into privilege escalation.
Know when Miniorange Otp Verification gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote OTP-verification bypass yields privilege escalation with no user interaction, so AV:N/AC:L/PR:N/UI:N and full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
Executive ViewAI
The miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) contains a critical privilege escalation vulnerability (CVSS 9.8) exploitable by unauthenticated attackers to gain administrative control without credentials; no public exploit has been identified at time of analysis. Any WordPress site running this plugin faces immediate risk of complete system compromise, data theft, and account hijacking. With no vendor patch currently available, organizations must take emergency remediation measures to prevent breach.
No vendor-released patch identified at time of analysis. Deploy these interim mitigations: (1) Disable and remove the plugin from production environments; (2) If removal is not feasible, implement Web Application Firewall (WAF) blocking rules for OTP verification endpoints, restricting access to whitelisted IP ranges; (3) Enforce multi-factor authentication (MFA) on all administrative accounts as a secondary control; (4) Enable detailed logging and alerting on privilege escalation attempts and administrative account modifications; (5) Actively evaluate and transition to an alternative, actively-maintained OTP authentication solution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB