Miniorange Otp Login Verification And Sms Notifications
Monthly
Unauthenticated account takeover of WordPress sites running miniOrange OTP Login, Verification and SMS Notifications through 5.5.8 is possible because the Delay OTP grace flag is stored per user rather than being bound to the originating session, cookie, IP address, or device. When OTP-only login and Delay OTP Verification are enabled and the target account is inside its grace interval, an attacker can submit a known username with `mo_wp_login_intent=otp` and any non-empty password to inherit that user's verified state and log in as any account, including administrators. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and exploitation is constrained by non-default settings plus a race-window timing precondition (CVSS 8.1, AC:H).
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin (all versions up to and including 5.5.5) allows an unauthenticated remote attacker to log in as any existing administrator account by submitting only a known admin username, an empty password, and the POST parameter mo_wp_login_intent=otp - no password or OTP check is ever performed. Exploitation requires a specific, non-default configuration in which the site administrator has simultaneously enabled WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass; that prerequisite stack is the primary limiting factor and is why our independent assessment rates the issue AC:H rather than the AC:L assumed by the published 9.8 score, while the impact ceiling (full WordPress site takeover via an administrator session) remains high. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so risk is real but contingent on the vulnerable option combination being present; the upstream plugin repository shows a code fix commit.
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.1) lets unauthenticated attackers take over any Administrator account. Because um_reset_password_process_hook() never verifies server-side that the OTP step was completed and trusts a form_nonce that the plugin itself hands to anonymous visitors via the moumprvar JavaScript object, an attacker can supply an arbitrary username_b value to receive a fresh password-reset URL for any user in the 302 Location header. No public exploit identified at time of analysis, but the flaw is trivially scriptable and carries a critical 9.8 CVSS score.
Unauthenticated account takeover of WordPress sites running miniOrange OTP Login, Verification and SMS Notifications through 5.5.8 is possible because the Delay OTP grace flag is stored per user rather than being bound to the originating session, cookie, IP address, or device. When OTP-only login and Delay OTP Verification are enabled and the target account is inside its grace interval, an attacker can submit a known username with `mo_wp_login_intent=otp` and any non-empty password to inherit that user's verified state and log in as any account, including administrators. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and exploitation is constrained by non-default settings plus a race-window timing precondition (CVSS 8.1, AC:H).
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin (all versions up to and including 5.5.5) allows an unauthenticated remote attacker to log in as any existing administrator account by submitting only a known admin username, an empty password, and the POST parameter mo_wp_login_intent=otp - no password or OTP check is ever performed. Exploitation requires a specific, non-default configuration in which the site administrator has simultaneously enabled WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass; that prerequisite stack is the primary limiting factor and is why our independent assessment rates the issue AC:H rather than the AC:L assumed by the published 9.8 score, while the impact ceiling (full WordPress site takeover via an administrator session) remains high. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so risk is real but contingent on the vulnerable option combination being present; the upstream plugin repository shows a code fix commit.
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.1) lets unauthenticated attackers take over any Administrator account. Because um_reset_password_process_hook() never verifies server-side that the OTP step was completed and trusts a form_nonce that the plugin itself hands to anonymous visitors via the moumprvar JavaScript object, an attacker can supply an arbitrary username_b value to receive a fresh password-reset URL for any user in the 302 Location header. No public exploit identified at time of analysis, but the flaw is trivially scriptable and carries a critical 9.8 CVSS score.