583 matches found
CVE-2026-15013
CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 Auth Bypass PoC Proof-of-concept for CVE-2026-15013 : unauthenticated authentication bypass via SAML Signature Algorithm Confusion HMAC-SHA1 in the miniOrange SAML Single Sign On – SSO Login WordPress plugin versions up to and including 5.4.3. Authoriz...
CVE-2026-77771
CVE-2026-77771 — miniOrange 2FA Free & Pro: 2FA Bypass via Session-Scoped OTP Lockout An authentication bypass in the miniOrange Two-Factor Authentication plugin for WordPress allows an attacker who already holds a victim's valid password to brute-force the second factor without limit, defeating...
CVE-2026-54852
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...
CVE-2026-54852 WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...
CVE-2026-54852
The miniOrange Page Restriction WordPress (WP) plugin, specifically versions up to and including 1.6.1 , is vulnerable to a Missing Authorization (Broken Access Control) flaw. The vulnerability arises from incorrectly configured access control security levels , which could allow unauthorized acti...
EUVD-2026-112887
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.1...
CVE-2026-114696
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...
CVE-2026-114696 WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...
CVE-2026-114696
The miniOrange Page Restriction WordPress (WP) plugin (versions up to and including 1.6.0 ) contains a Missing Authorization vulnerability. This security flaw allows for the exploitation of incorrectly configured access control security levels , potentially bypassing intended restrictions. Exploi...
CVE-2026-114696 WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...
EUVD-2026-108076
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...
PT-2026-121311
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...
WordPress miniOrange 2FA plugin 6.2.9-6.3.0 - 2FA Bypass vulnerability
2FA Bypass vulnerability discovered by RIA Labs in WordPress Plugin miniOrange's Google Authenticator versions 6.2.9-6.3.0...
CVE-2026-111949
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...
CVE-2026-111949
The miniOrange 2FA WordPress plugin versions before 6.3.1 is vulnerable to a 2FA bypass due to improper handling of passkey registrations. The root cause is that the plugin fails to prevent a pending passkey login from registering an additional passkey on an account that already has one configure...
EUVD-2026-107076
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...
CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...
CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...
PT-2026-120471
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...
