CVE-2026-12695

CVE-2026-12695 concerns the miniOrange 2FA WordPress plugin (pre-6.2.6). The vulnerability arises because the plugin does not validate the submitted one-time password (OTP) against the targeted user’s stored secret; instead it verifies the OTP against an attacker-supplied value. This enables an u...