EUVD-2026-57972

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-61967

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-61967

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-61967 WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-61967

CVE-2026-61967 concerns an unauthenticated privilege-escalation vulnerability in the WordPress plugin miniorange OTP Verification (versions

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin miniorange otp verification versions = 5.5.1...

EUVD-2026-54204

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619 miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The CVE-2026-16619 entry affects the miniOrange 2FA WordPress plugin, specifically versions before 6.2.8. The vulnerability arises because the plugin does not properly limit second-factor verification attempts; it tracks attempts using a client-supplied identifier that is reissued on every login,...

CVE-2026-16036

CVE-2026-16036 affects the miniOrange 2FA WordPress plugin prior to version 6.2.7. The issue is that during the pre-login two-factor challenge, the second factor being configured is not bound to the target account’s existing factor. This enables an attacker who knows a user’s password to rebind t...

EUVD-2026-53120

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled...

CVE-2026-16035

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

CVE-2026-16035

CVE-2026-16035 affects the miniOrange 2FA WordPress plugin prior to version 6.2.7. The vulnerability arises because the plugin does not restrict who can trigger the second-factor configuration OTP send, nor does it bind the OTP recipient to the enrolling user’s address. As a result, a low-privile...

CVE-2026-16035 miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

CVE-2026-12695

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

CVE-2026-12695 miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

CVE-2026-12695

CVE-2026-12695 concerns the miniOrange 2FA WordPress plugin (pre-6.2.6). The vulnerability arises because the plugin does not validate the submitted one-time password (OTP) against the targeted user’s stored secret; instead it verifies the OTP against an attacker-supplied value. This enables an u...

EUVD-2026-51436

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor...

WordPress miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin < 7.8.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Lyris Vale in WordPress Plugin WordPress Social Login and Register versions 7.8.0...