What’s Vulnerable › Vulnerabilities
CVE-2026-77771: miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-10 · updated 2026-09-10
- Weakness: CWE-287
Description
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
Affected products
- miniOrange 2FA: from 6.2.8 before 6.3.1; from 18.0 before 19.3 — fixed in 19.3, 6.3.1
How to fix
Upgrade to a fixed version: miniOrange 2FA 19.3, 6.3.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-77771 or the next vulnerability affects your stack