miniOrange 2FA
miniOrange 2FA adds two-factor authentication options to WordPress user login processes.
miniOrange 2FA (miniorange-2fa) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Aug 06, 2026; the highest published CVSS base score is 8.1.
miniorange-2faCVE-2026-16619: miniOrange 2FA permits unlimited one-time-code guessing before 6.2.8
miniOrange 2FA before 6.2.8 tracks failed second-factor attempts against a client-supplied session_id that is replaced when login restarts instead of against the target account. An attacker who knows a user's WordPress password can post guessed mo2fa_softtoken values to admin-ajax.php using action mo_two_factor_ajax and mo_2f_two_factor_ajax=mo2f_validate_user_for_login; restarting for a fresh session_id resets the effective quota. Version 6.2.8 changes mo2f_validate_user_for_login() and mo2f_handle_attempt_validation() to enforce an account-keyed five-minute lockout.
| Safe version |
|
||
|---|---|---|---|
| Aug 06, 2026 |
CVE-2026-16619
miniOrange 2FA permits unlimited one-time-code guessing before 6.2.8
miniOrange 2FA before 6.2.8 tracks failed second-factor attempts against a client-supplied session_id that is replaced when login restarts instead of against the target account. An attacker who knows a user's WordPress password can post guessed mo2fa_softtoken values to admin-ajax.php using action mo_two_factor_ajax and mo_2f_two_factor_ajax=mo2f_validate_user_for_login; restarting for a fresh session_id resets the effective quota. Version 6.2.8 changes mo2f_validate_user_for_login() and mo2f_handle_attempt_validation() to enforce an account-keyed five-minute lockout.
|
6.2.8 |
CVE7.5
NVDPending
|
| Aug 05, 2026 |
CVE-2026-16036
miniOrange pre-login enrollment permits second-factor rebinding
miniOrange 2FA before 6.2.7 does not bind a newly configured second factor during the pre-login challenge to the target account's existing factor. An attacker who knows a user's password can redirect or re-enroll that user's second factor to an attacker-controlled destination, complete the challenge and obtain the account session, including an administrator session. This unscored record received deeper review because it bypasses the second authentication factor. The CNA does not disclose the challenge route, enrollment action or parameters.
|
6.2.7 |
CVE7.5
NVDPending
|
| Aug 04, 2026 |
CVE-2026-16035
miniOrange 2FA lets low-privilege users redirect and exhaust OTP delivery
miniOrange 2FA before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send and does not bind the destination address to the enrolling user. A low-privilege authenticated user can send OTP messages to arbitrary recipients and consume the site's metered OTP allowance, preventing legitimate users from receiving configuration codes. The public advisory does not disclose the minimum role, endpoint, action, recipient parameter or quota-enforcement function.
|
6.2.7 |
CVE4.3
NVDPending
|
| Jul 31, 2026 |
CVE-2026-12695
miniOrange 2FA accepts an attacker-supplied OTP secret
miniOrange 2FA before 6.2.6 verifies a submitted one-time password against an attacker-supplied value instead of the targeted user's stored secret. An unauthenticated attacker who already knows a victim's WordPress password can therefore supply matching OTP material, bypass the victim's second factor and take over that account, including an Administrator account. The published record does not disclose the login action, request-field names or OTP-validation function.
|
6.2.6 |
CVE8.1
NVDPending
|