miniOrange 2FA EUVD-2026-53120

The attacker must independently possess the target user's valid WordPress account password, obtained via credential stuffing, phishing, or a prior data breach - this vulnerability does not itself expose credentials. The miniOrange 2FA plugin must be installed, active, and configured with two-factor authentication enabled on the target WordPress site, running any version prior to 6.2.7. No special server-side configuration, non-default plugin settings, or privileged network position is required beyond having 2FA active and the site reachable over the network. Exploitation is concretely limited by two factors: the attacker must first hold a valid password for the targeted account (preventing unauthenticated mass exploitation), and the attack is per-account and targeted rather than a single request that compromises all users.

The published CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is inconsistent with the described account-takeover impact and appears to be a scoring error - full account compromise implies C:H/I:H, not A:H with no confidentiality or integrity impact. Risk calibration must not rely on the published vector. A corrected assessment yields a score closer to 9.1 (C:H/I:H/A:N). EPSS at 0.14% (4th percentile) indicates low current exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread active exploitation at time of analysis. However, a publicly available proof-of-concept exists via WPScan, materially lowering the bar for exploitation. The attack targets administrator accounts on WordPress installations - a high-value class enabling full site compromise, content injection, and supply-chain risk for site visitors. The prerequisite of holding the victim's password limits opportunistic mass exploitation but makes this an attractive second-stage weapon following credential stuffing, phishing, or breach exposure. Real-world priority should be elevated beyond what the EPSS score alone suggests for any organization where WordPress admin credentials may have been previously exposed.

An attacker who has obtained a WordPress user's password via credential stuffing from a prior data breach navigates to the target site's login page, submits the valid credentials to enter the pre-login 2FA challenge phase, and then - rather than supplying the victim's registered second factor - submits a factor reconfiguration request pointing to their own authenticator app or phone number. With the factor rebound to the attacker-controlled destination, the attacker completes the 2FA challenge using their own device and gains full authenticated access to the account. A publicly available exploit hosted at the WPScan advisory URL exists, meaning this scenario requires no original exploit development.