CVE-2026-12695

CVE-2026-12695 affects the miniOrange 2FA WordPress plugin, pre-6.2.6. The vulnerability bypasses two-factor authentication by validating theOTP against an attacker-controlled value instead of the stored user secret, enabling unauthenticated access if the attacker knows the victim’s password (pot...