CVE-2026-85984

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.5 ) is vulnerable to an Authentication Bypass . The root cause is a missing password-intent guard in the mo_by_pass_login() function when the skip_pass_fallback configuration is ena...

CVE-2026-85984: Improper Authentication

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...

PT-2026-99412

Name of the Vulnerable Software and Affected Versions miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.6 Description An authentication bypass exists when the mo wp login intent parameter is used. The issue occurs within the mo by pass login function, specifically in...

WordPress miniOrange 2FA plugin < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding vulnerability

2FA Bypass via Password-Only Second-Factor Rebinding vulnerability discovered by Artus KG in WordPress Plugin miniOrange's Google Authenticator versions 6.2.7...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

EUVD-2026-79746

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress (before 4.8.0 ) contains an authentication method downgrade vulnerability. An unauthenticated attacker can supply a specific GET parameter that bypasses capability checks and nonce verification, forcing the plugin to use Basic HT...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027: Missing Authentication for Critical Function

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

PT-2026-93110

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

Exploit for CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA WordPre...

Exploit for CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: 2FA Bypass via S...

WordPress miniOrange 2FA plugin 18.0-19.2 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 5.3.24-6.3.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 5.3.24-6.3.0...

WordPress miniOrange 2FA plugin 18.0-19.2 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 6.2.8-6.3.0 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 6.2.8-6.3.0...

CVE-2026-77771

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

CVE-2026-77770

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...