What’s Vulnerable › Vulnerabilities
CVE-2026-16619: miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-08-26
- Weakness: CWE-307
Description
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
Affected products
- miniOrange 2FA: before 6.2.8 — fixed in 6.2.8
How to fix
Upgrade to a fixed version: miniOrange 2FA 6.2.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-16619 or the next vulnerability affects your stack