CVE-2026-77770

miniOrange 2FA WordPress plugin (Free and Pro) is affected by an unauthenticated arbitrary option deletion vulnerability in versions before 6.3.1 (Free) and 19.3 (Pro). The plugin fails to require a validated transaction before deleting site options whose names originate from unauthenticated requ...

EUVD-2026-75263

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

EUVD-2026-75264

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

CVE-2026-77771

miniOrange 2FA WordPress plugin (Free & Pro) versions before 6.3.1 (Free) and before 19.3 (Pro) fail to scope their second-factor attempt limit to the target account. Instead, the lockout is keyed to a client-supplied identifier that an attacker can change at will, enabling unlimited one-time-pas...

CVE-2026-12695 miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...