What is the CVSS score of EUVD-2026-51436?

EUVD-2026-51436 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of miniOrange 2FA are affected by EUVD-2026-51436?

The miniOrange 2FA WordPress plugin (versions before 6.2.6) contains a critical authentication bypass allowing attackers with password knowledge to bypass two-factor authentication and gain full…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51436?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51436. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-51436?

Within 24 hours: inventory all WordPress installations running miniOrange 2FA plugin and identify affected versions prior to 6.2.6. Within 7 days: update miniOrange 2FA plugin to version 6.2.6 or later on all affected sites, force password reset for all administrator accounts, and examine authentication logs for unauthorized access attempts. Within 30 days: deploy monitoring for anomalous login patterns and verify absence of unauthorized plugin code modifications.

miniOrange 2FA EUVD-2026-51436

| CVE-2026-12695 HIGH

Improper Authentication (CWE-287)

2026-07-31 WPScan

GHSA-24j9-5c5r-9c88

WordPress Authentication Bypass Miniorange 2fa Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AC:H reflects the mandatory prerequisite of possessing the victim's password; PR:N and UI:N apply because no session or interaction is needed once credentials are in hand, and full C/I/A applies given admin account takeover potential.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:32 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

8.1 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. A publicly available proof-of-concept exists per WPScan; however, EPSS probability stands at 0.19% (9th percentile) and SSVC exploitation status is classified as 'none,' indicating no confirmed mass exploitation at time of analysis.

Technical ContextAI

The vulnerability resides in the OTP verification routine of the miniOrange 2FA WordPress plugin (CPE: cpe:2.3:a:unknown:miniorange_2fa:*:*:*:*:*:*:*:*). Standard TOTP validation derives the expected one-time password from the user's stored secret using a time-based algorithm and compares it to the value submitted by the authenticating party. The flawed implementation instead accepts an attacker-supplied comparison target from the request itself, creating a scenario where the plugin validates the submitted OTP against a value the attacker controls - effectively allowing the attacker to pass any OTP check by submitting matching values on both sides of the comparison. This maps precisely to CWE-287 (Improper Authentication): the authentication mechanism's oracle is poisoned by the untrusted party seeking access, making the 2FA layer entirely ineffective for accounts targeted by an attacker who has already acquired the primary password.

RemediationAI

The primary fix is to upgrade the miniOrange 2FA WordPress plugin to version 6.2.6 or later, which corrects the OTP validation logic to compare the submitted value against the internally derived TOTP secret rather than an attacker-supplied parameter; the patch is confirmed available from the vendor. Update via the WordPress admin Plugins panel or wp-cli ('wp plugin update miniorange-2-factor-authentication'). If immediate upgrade is operationally blocked, a compensating control is to disable the miniOrange 2FA plugin entirely from the WordPress admin panel - this removes the vulnerable code path but also eliminates 2FA protection, so it should be paired with restricting wp-login.php access to known IP ranges via server configuration or a WAF rule to preserve access control posture. Avoid treating plugin deactivation as a permanent solution. Advisory and POC details are at https://wpscan.com/vulnerability/1994ce51-3534-4cb3-b424-d2f9014e8bb3/.