EUVD-2026-51436
GHSA-24j9-5c5r-9c88
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the mandatory prerequisite of possessing the victim's password; PR:N and UI:N apply because no session or interaction is needed once credentials are in hand, and full C/I/A applies given admin account takeover potential.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.
Articles & Coverage 1
AnalysisAI
Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have obtained the targeted WordPress user's valid username and password through a separate prior attack (credential phishing, stuffing, or breach data) - this is the single gatekeeping prerequisite encoded in CVSS AC:H and is the primary real-world limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately represents a high-severity vulnerability tempered by a meaningful prerequisite: AC:H encodes the requirement that the attacker must first obtain the victim's WordPress password through a separate attack (phishing, credential stuffing, breach replay), making this a second-stage chained attack rather than opportunistic exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker acquires a WordPress administrator's password through a prior credential theft (phishing campaign or breach replay), then initiates login on a site running miniOrange 2FA before 6.2.6; during the 2FA step, the attacker submits a crafted request where the OTP value and the comparison parameter are both set to an identical attacker-chosen string, which the plugin incorrectly accepts as valid. Full administrator access is obtained without ever possessing or computing a legitimate TOTP code. … |
| Remediation | The primary fix is to upgrade the miniOrange 2FA WordPress plugin to version 6.2.6 or later, which corrects the OTP validation logic to compare the submitted value against the internally derived TOTP secret rather than an attacker-supplied parameter; the patch is confirmed available from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WordPress installations running miniOrange 2FA plugin and identify affected versions prior to 6.2.6. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Miniorange 2fa
View allCross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forg
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows
Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.0.0 before 4.7.0,
Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services w
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today