miniOrange 2FA EUVD-2026-51436

The attacker must have obtained the targeted WordPress user's valid username and password through a separate prior attack (credential phishing, stuffing, or breach data) - this is the single gatekeeping prerequisite encoded in CVSS AC:H and is the primary real-world limiting factor. The miniOrange 2FA plugin must be installed, active, and enforcing 2FA for the targeted account. Beyond these two conditions, no special server-side configuration, non-default settings, or privileged access to the WordPress installation are required. There is no required victim interaction. Exploitation is limited to WordPress instances running miniOrange 2FA versions prior to 6.2.6; sites on 6.2.6 or later, or sites not using this specific plugin, are not affected.

The CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately represents a high-severity vulnerability tempered by a meaningful prerequisite: AC:H encodes the requirement that the attacker must first obtain the victim's WordPress password through a separate attack (phishing, credential stuffing, breach replay), making this a second-stage chained attack rather than opportunistic exploitation. The C:H/I:H/A:H triple reflects the reality that administrator-level account takeover grants full WordPress site control. EPSS at 0.19% (9th percentile) and SSVC exploitation classification of 'none' both independently indicate the publicly available POC has not yet translated into widespread automated exploitation - consistent with the AC:H constraint limiting attacks to targeted, credential-in-hand scenarios. The SSVC automatable assessment of 'no' aligns with this: mass automation is blocked by the credential prerequisite. Despite the low EPSS, the technical impact designation of 'total' reflects the severity once conditions are met. Priority should be elevated for any WordPress site where miniOrange 2FA is enforced for privileged accounts, as the entire second factor provides no protection against a credential-equipped attacker.

An attacker acquires a WordPress administrator's password through a prior credential theft (phishing campaign or breach replay), then initiates login on a site running miniOrange 2FA before 6.2.6; during the 2FA step, the attacker submits a crafted request where the OTP value and the comparison parameter are both set to an identical attacker-chosen string, which the plugin incorrectly accepts as valid. Full administrator access is obtained without ever possessing or computing a legitimate TOTP code. A publicly available proof-of-concept documents this request manipulation.