What is the CVSS score of EUVD-2026-57972?

EUVD-2026-57972 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of miniOrange OTP Verification are affected by EUVD-2026-57972?

The miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) contains a critical privilege escalation vulnerability (CVSS 9.8) exploitable by unauthenticated attackers to gain…

How to fix or mitigate EUVD-2026-57972?

Within 24 hours, inventory all WordPress installations using miniOrange OTP Verification plugin version 5.5.1 or earlier and prepare for immediate deactivation. Within 7 days, either uninstall the plugin from all production environments or implement compensating controls including Web Application Firewall (WAF) rules that restrict OTP verification endpoint access to pre-approved IP addresses only. Within 30 days, monitor miniOrange's advisory channels for patch availability and plan migration to an alternative OTP provider with active security maintenance and current certifications.

miniOrange OTP Verification EUVD-2026-57972

| CVE-2026-61967 CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-08-13 Patchstack

GHSA-56v2-rm7h-g26f

WordPress Privilege Escalation Wordpress Plugin Miniorange Otp Verification Miniorange

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote OTP-verification bypass yields privilege escalation with no user interaction, so AV:N/AC:L/PR:N/UI:N and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:46 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

AnalysisAI

Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.

Technical ContextAI

The affected component is the miniOrange OTP Verification plugin for WordPress, which adds one-time-password verification to registration, login, and form flows (CPE cpe:2.3:a:miniorange:miniorange_otp_verification). The assigned CWE-640 (Weak Password Recovery / Verification Mechanism for Forgotten Password) indicates the root cause lies in how the plugin validates OTP-based identity or recovery challenges - for example predictable, reusable, or improperly enforced OTP checks that an attacker can satisfy or bypass. Because OTP verification gates account creation and authentication in WordPress, a weakness here can be leveraged to register or authenticate as a higher-privileged account, translating a verification bypass into privilege escalation.

RemediationAI

Upgrade the miniOrange OTP Verification plugin to a release newer than 5.5.1 as soon as the vendor publishes it; the affected range is <= 5.5.1 but the exact patched version is not confirmed in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-5-5-1-privilege-escalation-vulnerability) and the plugin's WordPress.org changelog to confirm the fixed build. If an update is not yet available, compensating controls include temporarily deactivating the OTP Verification plugin (trade-off: removes OTP-based verification from registration/login flows), restricting access to the affected verification/registration endpoints via WAF or web-server rules, and disabling open user registration in WordPress settings to limit who can trigger the flow. Monitor for unexpected new administrator or elevated-privilege accounts.