Miniorange 2fa
Monthly
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0.
Account takeover in the miniOrange 2FA WordPress plugin before 6.2.7 is enabled when an attacker already possesses a target user's password - the plugin fails to bind a newly configured second factor to the target account's existing registered factor during the pre-login two-factor challenge, allowing the attacker to redirect 2FA enrollment to an attacker-controlled device, complete the challenge, and authenticate as the victim including as site administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating exploitation has not yet become widespread. Critically, the published CVSS vector (C:N/I:N/A:H) severely misrepresents the actual impact - this is a full account-takeover flaw with high confidentiality and integrity consequences, not a denial-of-service; analysts should not use the published vector for risk calibration.
Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. A publicly available proof-of-concept exists per WPScan; however, EPSS probability stands at 0.19% (9th percentile) and SSVC exploitation status is classified as 'none,' indicating no confirmed mass exploitation at time of analysis.
Missing authorization in the miniOrange 2FA WordPress plugin before 6.2.7 allows any authenticated low-privileged user to trigger OTP email delivery to arbitrary email addresses and exhaust the site's metered OTP quota. The plugin's second-factor enrollment endpoint neither restricts which users may invoke it nor binds the OTP recipient to the enrolling user's own address, enabling both unsolicited OTP email delivery and a denial-of-service attack against other users' 2FA flows. No public exploitation or KEV listing has been identified, though a public proof-of-concept is available via WPScan; EPSS stands at 0.13% (3rd percentile), indicating low observed exploitation activity.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0 before 5.1.*.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0.
Account takeover in the miniOrange 2FA WordPress plugin before 6.2.7 is enabled when an attacker already possesses a target user's password - the plugin fails to bind a newly configured second factor to the target account's existing registered factor during the pre-login two-factor challenge, allowing the attacker to redirect 2FA enrollment to an attacker-controlled device, complete the challenge, and authenticate as the victim including as site administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating exploitation has not yet become widespread. Critically, the published CVSS vector (C:N/I:N/A:H) severely misrepresents the actual impact - this is a full account-takeover flaw with high confidentiality and integrity consequences, not a denial-of-service; analysts should not use the published vector for risk calibration.
Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. A publicly available proof-of-concept exists per WPScan; however, EPSS probability stands at 0.19% (9th percentile) and SSVC exploitation status is classified as 'none,' indicating no confirmed mass exploitation at time of analysis.
Missing authorization in the miniOrange 2FA WordPress plugin before 6.2.7 allows any authenticated low-privileged user to trigger OTP email delivery to arbitrary email addresses and exhaust the site's metered OTP quota. The plugin's second-factor enrollment endpoint neither restricts which users may invoke it nor binds the OTP recipient to the enrolling user's own address, enabling both unsolicited OTP email delivery and a denial-of-service attack against other users' 2FA flows. No public exploitation or KEV listing has been identified, though a public proof-of-concept is available via WPScan; EPSS stands at 0.13% (3rd percentile), indicating low observed exploitation activity.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0 before 5.1.*.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.