miniOrange OTP Verification EUVD-2026-32177

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network access to a WordPress site that has the miniOrange OTP Verification plugin installed and active at version 5.4.9 or earlier, with no authentication and no user interaction needed. The limiting factor is therefore deployment-specific rather than configuration-specific: the site must be running the vulnerable plugin version in an active state. The input description does not name a specific feature toggle or non-default setting as a precondition, so the constraint is presence of the affected plugin version; sites not running this plugin, or running a fixed release above 5.4.9, are not exposed.

The CVSS 3.1 base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, signaling network-exploitable, low-complexity, unauthenticated, no-interaction attack with high impact across all three dimensions - the strongest possible signal short of scope change. However, corroborating exploitation signals are absent: no EPSS score was provided, the CVE is not in CISA KEV, no POC was referenced, and no SSVC decision data was supplied, so real-world exploitation likelihood cannot be quantified from this dataset. This means the score reflects worst-case potential rather than confirmed active risk; for WordPress plugin privilege-escalation flaws reported by Patchstack the practical risk is typically meaningful because such plugins are widely deployed and internet-facing, but the lack of EPSS/KEV/POC means defenders should treat the 9.8 as a strong prioritization trigger to patch rather than as evidence of ongoing mass exploitation. No conflicting signals were detected between the vector and the description - both point to remote, unauthenticated privilege escalation.

A remote attacker sends crafted requests to the OTP verification flow exposed by a vulnerable WordPress site, abusing the incorrect privilege assignment to obtain elevated capabilities (potentially administrator-level) without supplying valid credentials or requiring any victim interaction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to the site and low attack complexity. No public exploit was referenced in the available data.