miniOrange 2FA CVE-2026-77771

The attacker must already possess the target account's WordPress password - this is the primary prerequisite and is captured by AC:H in the CVSS vector. The miniOrange 2FA plugin must be installed, active, and running a vulnerable version (below 6.3.1 in the 6.x branch or below 19.3 in the 18.x/19.x branch). 2FA must be enabled for the target account. No user interaction is required once credentials are in hand. Exploitation is limited to accounts where 2FA is enforced via this specific plugin; accounts without 2FA or using a different 2FA plugin are unaffected. Network access to the WordPress login endpoints is required.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.5 (High). AC:H correctly reflects the prerequisite of having the victim's password; however, PR:L is questionable - the attacker is not authenticated to any account, and the password-knowledge prerequisite is more accurately captured by AC:H than by a privilege level. C:H/I:H/A:H is justified because successful 2FA bypass yields full WordPress account takeover. A publicly available WPScan proof-of-concept elevates real-world risk well above what the CVSS score alone might suggest. No KEV listing is present, indicating no confirmed mass exploitation at time of analysis, but the PoC reduces the skill barrier significantly. EPSS data is not provided; given the WordPress ecosystem's size and the availability of public exploit code, opportunistic exploitation targeting WordPress admin accounts is a realistic near-term concern. The attack is conditional on prior credential compromise, making credential hygiene and breach-monitoring a meaningful compensating layer.

An attacker obtains a victim's WordPress credentials via phishing or a credential-dump leak, then initiates a login attempt against the 2FA-protected account. By scripting OTP submission against the unrate-limited validation endpoint - or by rotating the client-supplied identifier between attempts on the rate-limited endpoint - the attacker exhausts the 6-digit TOTP space within seconds to minutes, bypassing 2FA entirely. The publicly available WPScan PoC confirms this workflow is readily automatable.