EUVD-2026-42543
GHSA-26hr-8h4j-gxx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLoad public UM reset page
-
DeliveryScrape form_nonce from moumprvar JS
-
ExploitPOST reset with username_b=admin
-
ExecutionCapture reset URL from 302 Location
-
PersistSet new admin password
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Ultimate Member Password Reset Form integration be active AND that the plugin is NOT configured for phone-only reset - both stated explicitly in the CVE description. When those conditions hold, no further prerequisites exist: the attack is remote and unauthenticated (PR:N), needs no user interaction (UI:N), the form_nonce is publicly emitted to anonymous visitors so it is not a secret, and the username_b parameter carries no role restriction so any account including Administrators can be targeted. The limiting factors that reduce real-world exposure are purely configuration-based: sites not using the Ultimate Member reset form, or running in phone-only mode, are not exploitable. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) is fully consistent with the description: remote, no authentication, no user interaction, resulting in complete account compromise, hence C/I/A all High. No EPSS score, KEV entry, or POC was provided, so exploitation frequency cannot be quantified and active exploitation is not confirmed (no public exploit identified at time of analysis). That said, the low complexity, absence of any role restriction, and the fact that the required nonce is publicly emitted make weaponization straightforward, so this warrants urgent patching rather than being a high-CVSS-but-low-real-risk case. The one genuine limiter is configuration: exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin not set to phone-only reset, so installations lacking that integration are not exposed. |
| Exploit ScenarioDerived | An unauthenticated attacker loads the public Ultimate Member password-reset page, scrapes form_nonce from the moumprvar JavaScript object, and submits a reset request with username_b set to a known administrator login. The server responds with a 302 whose Location header contains a valid reset URL for that admin account; the attacker follows it, sets a new password, and logs in with full control. No public exploit code was identified at time of analysis, but the low complexity (AV:N/AC:L) makes it a single scripted HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.1) lets unauthenticated attackers take over any Administrator account. Because um_reset_password_process_hook() never verifies server-side that the OTP step was completed and trusts a form_nonce that the plugin itself hands to anonymous visitors via the moumprvar JavaScript object, an attacker can supply an arbitrary username_b value to receive a fresh password-reset URL for any user in the 302 Location header. No public exploit identified at time of analysis, but the flaw is trivially scriptable and carries a critical 9.8 CVSS score.
RemediationAI
Upgrade the plugin to the fixed release published after 5.5.1; an upstream fix is available (see the plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3595061%40miniorange-otp-verification&new=3595061%40miniorange-otp-verification), but the exact patched version number was not included in the source data, so confirm the release via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d34f4e77-f384-4d84-be32-0d349962b614?source=cve before deploying. If immediate patching is not possible, disable the Ultimate Member Password Reset Form integration (removes the vulnerable path but breaks OTP-based password reset for legitimate users), or switch the plugin to phone-only reset mode, which the description states is unaffected (trade-off: users without a registered phone lose reset ability). As a network control, place the Ultimate Member reset endpoint behind IP allowlisting or a WAF rule blocking unauthenticated requests that carry the username_b parameter, and audit Administrator accounts for unexpected password changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Ultimate Member password-reset integration of the miniOrange OTP plugin (class-moumpasswordreset.php). The plugin emits form_nonce into the moumprvar JavaScript object on the public Ultimate Member reset page, so the nonce is not a secret and is readable by any unauthenticated visitor. WordPress nonces are CSRF replay tokens, not authorization controls, so relying on one to gate a password reset is the textbook CWE-862 (Missing Authorization) root cause. The reset handler accepts an attacker-controlled username_b parameter and issues a valid reset key without confirming the prior OTP validation succeeded or that any OTP session is bound to the target user, collapsing the intended multi-factor reset flow into a single unauthenticated request. The affected package is identified by CPE cpe:2.3:a:cyberlord92:miniorange_otp_login,_verification_and_sms_notifications.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, single-request admin takeover using a public nonce with no role check justifies AV:N/AC:L/PR:N/UI:N and full C/I/A High; the config prerequisite is not a CVSS base metric.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the um_reset_password_process_hook() function performing no server-side verification that the OTP validation step was completed, and relying solely on a public form_nonce nonce that the plugin itself emits to unauthenticated visitors via the moumprvar JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled username_b parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account - returned in a 302 Location header - and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.
Articles & Coverage 1
Executive ViewAI
The miniOrange OTP Login plugin for WordPress (versions through 5.5.1) contains a critical authentication bypass allowing unauthenticated attackers to seize any administrator account without valid credentials. Organizations using this plugin face immediate risk of complete WordPress takeover and potential compromise of underlying business systems and data accessible through WordPress.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) immediately uninstall the plugin-most effective control; (2) if uninstall is infeasible, restrict all plugin endpoints via Web Application Firewall to known internal IP ranges only; (3) enforce MFA on all WordPress administrator accounts via alternative authentication provider; (4) implement detailed logging and alerting on all password reset requests and admin account modifications; (5) maintain current full WordPress backups offline for rapid restoration if compromise is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB