What is the CVSS score of EUVD-2026-75263?

EUVD-2026-75263 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of miniOrange 2FA are affected by EUVD-2026-75263?

The miniOrange 2FA WordPress plugin (versions 5.3.24-6.3.0 and 18.0-19.2) contains a critical unauthenticated vulnerability allowing any visitor to delete administrator accounts and disable…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-75263?

Yes, a public proof-of-concept exploit is available for EUVD-2026-75263. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-75263?

Within 24 hours, identify all WordPress installations using miniOrange 2FA plugin versions 5.3.24-6.3.0 or 18.0-19.2 and restrict external network access to those systems if immediate patching is not possible. Within 7 days, upgrade affected installations to miniOrange 2FA version 6.3.1 (for 5.3.x-6.x line) or version 19.3 (for 18.x-19.x line), then verify that 2FA authentication is still active and functional for all administrator accounts. Within 30 days, audit WordPress wp_options database tables on all previously affected systems for evidence of unauthorized option deletions and review authentication logs for exploitation attempts using publicly available WPScan proof-of-concept tooling.

miniOrange 2FA EUVD-2026-75263

| CVE-2026-77770 CRITICAL

Missing Authorization (CWE-862)

2026-09-10 WPScan

GHSA-vfpr-3q2h-v432

WordPress Authentication Bypass Miniorange 2fa Unknown

10.0

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network deletion of arbitrary options damages site integrity and availability (lockout/deactivation) with no data disclosure; impact stays within the WordPress app so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 11, 2026 - 11:23 vuln.today

Analysis Generated

Sep 10, 2026 - 14:30 vuln.today

Patch available

Sep 10, 2026 - 07:01 EUVD

CVE Published

Sep 10, 2026 - 06:00 cve.org

CRITICAL 10.0

CVE Published

Sep 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Articles & Coverage 1

News Critical Unauthenticated Option Deletion in miniOrange 2FA WordPress Plugin - CVE-2026-77770 Sep 10, 2026

AnalysisAI

Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires only that the target site runs miniOrange 2FA WordPress plugin in a vulnerable version (5.3.24-6.3.0 or 18.0-19.2) with the vulnerable option-deletion request handler reachable - no authentication, no user interaction, and default configurations are exploitable (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Multiple signals converge on high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack, and CISA's SSVC framework marks it Automatable=yes, meaning it can be scripted and sprayed at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to miniOrange 2FA 6.3.1 (if on the 5.3.24-6.3.0 branch) or 19.3 (if on the 18.0-19.2 branch) - apply whichever fixed release matches your installed branch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all WordPress installations using miniOrange 2FA plugin versions 5.3.24-6.3.0 or 18.0-19.2 and restrict external network access to those systems if immediate patching is not possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.