miniOrange 2FA CVE-2026-77770

Requires only that the target site runs miniOrange 2FA WordPress plugin in a vulnerable version (5.3.24-6.3.0 or 18.0-19.2) with the vulnerable option-deletion request handler reachable - no authentication, no user interaction, and default configurations are exploitable (AV:N/AC:L/PR:N/UI:N). The specific trigger is a request supplying an attacker-chosen option name to the deletion path that fails to require a validated transaction. The main limiting factors are simply having the plugin installed and network reachability to the WordPress endpoint; there is no privilege, platform, or non-default-setting prerequisite that constrains attackers.

Multiple signals converge on high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack, and CISA's SSVC framework marks it Automatable=yes, meaning it can be scripted and sprayed at scale. Publicly available exploit code (WPScan) plus a straightforward deletion primitive make weaponization trivial, though SSVC Exploitation is currently 'none' (no observed active exploitation) and it is not in CISA KEV - so treat this as high-likelihood-but-not-yet-confirmed-in-the-wild rather than an active campaign. There is tension worth noting: the CVSS is a perfect 10.0 partly because of S:C (scope change) and I:H/A:H, yet the concrete impact is availability-focused (admin lockout, plugin deactivation) with no confidentiality loss (C:N), and SSVC rates Technical Impact only 'partial' - so the 10.0 slightly overstates real-world severity, which is severe availability/integrity damage rather than full compromise. Even a mid-sized operator running this plugin should treat it as urgent because exploitation is unauthenticated and automatable, but the realistic outcome is denial-of-service/lockout, not data theft or code execution.

An attacker scans for WordPress sites running a vulnerable miniOrange 2FA version and sends a crafted unauthenticated HTTP request naming a critical site option (or looping through many option names) to the plugin's deletion handler. WordPress deletes the targeted options, deactivating the 2FA plugin and/or removing settings that lock every administrator out of wp-admin. Public exploit code from WPScan means this can be run at scale with no authentication and no user interaction.