CVE-2026-16036

CVE-2026-16036 affects the miniOrange 2FA WordPress plugin prior to version 6.2.7. The issue is that during the pre-login two-factor challenge, the second factor being configured is not bound to the target account’s existing factor. This enables an attacker who knows a user’s password to rebind t...