Vulnerabilities / miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) / WPSEC-2026-0214
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.3.1 - Unauthenticated Registration OTP Verification Bypass via Custom Registration Form
Medium 5.3
CWE-603Fixed in 6.3.2
- ID
- WPSEC-2026-0214
- Plugin
- miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) (miniorange-2-factor-authentication)
- Affected
- all versions before 6.3.2
- Remediation
- Update to 6.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-603
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) on WPSec AttackSurface
- Fix released
- Published
Description
The miniOrange 2FA plugin for WordPress is vulnerable to OTP Verification Bypass via the custom registration form shortcode in all versions up to, and including, 6.3.1. This is due to the email/phone OTP verification being enforced only on the client side, with no server-side check that the OTP was verified for the submitted identifier. This makes it possible for unauthenticated attackers to register accounts without verifying an OTP, or by verifying a different email address than the one registered, when the registration form shortcode feature is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0214/
- https://plugins.svn.wordpress.org/miniorange-2-factor-authentication/tags/6.3.2/
- https://wordpress.org/plugins/miniorange-2-factor-authentication/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS