What’s Vulnerable › Vulnerabilities
CVE-2026-77770: miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
- Severity: critical (CVSS 10.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-10 · updated 2026-09-10
- Weakness: CWE-862
Description
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
Affected products
- miniOrange 2FA: from 5.3.24 before 6.3.1; from 18.0 before 19.3 — fixed in 19.3, 6.3.1
How to fix
Upgrade to a fixed version: miniOrange 2FA 19.3, 6.3.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-77770 or the next vulnerability affects your stack