miniOrange 2FA lets low-privilege users redirect and exhaust OTP delivery
miniOrange 2FA before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send and does not bind the destination address to the enrolling user. A low-privilege authenticated user can send OTP messages to arbitrary recipients and consume the site's metered OTP allowance, preventing legitimate users from receiving configuration codes. The public advisory does not disclose the minimum role, endpoint, action, recipient parameter or quota-enforcement function.
- Component
- miniOrange 2FA
- Plugin slug
miniorange-2fa- Affected
- < 6.2.7
- Safe version
6.2.7- Published
- Aug 04, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 04, 2026 and is one of 4 known issues for this plugin.
Update, patch or deactivate.
Update miniOrange 2FA to 6.2.7 or later. Review OTP delivery logs and low-privilege account activity, and contact the OTP provider if the site's allowance was exhausted or messages were sent to unrelated recipients.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L