CVE-2026-16036

The CVE describes a vulnerability in the miniOrange 2FA WordPress plugin before version 6.2.7 where the second factor used during the pre-login two-factor challenge is not bound to the target account’s existing factor. An attacker who knows a user’s password can rebind that user’s second factor t...