CVE-2026-16035

The CVE concerns the miniOrange 2FA WordPress plugin prior to version 6.2.7. It allows a low-privilege user to trigger OTP sends to arbitrary recipients and to bind OTP delivery to the enrolling user’s address is not enforced, enabling misuse to email one-time-passcodes to unintended recipients a...