Miniorange 2fa

WordPress plugin · miniorange-2fa · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Miniorange 2fa on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 10.0	miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator CVE.org	>=5.3.24, <6.3.1	v6.3.1	CVE-2026-77770	Sep 10, 2026
HIGH CVSS 7.5	miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout CVE.org	>=6.2.8, <6.3.1	v6.3.1	CVE-2026-77771	Sep 10, 2026
HIGH CVSS 7.5	miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts CVE.org	>=0, <6.2.8	v6.2.8	CVE-2026-16619	Aug 6, 2026
HIGH CVSS 7.5	miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding CVE.org	>=0, <6.2.7	v6.2.7	CVE-2026-16036	Aug 5, 2026
HIGH CVSS 8.1	miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret CVE.org	>=0, <6.2.6	v6.2.6	CVE-2026-12695	Jul 31, 2026
MEDIUM CVSS 4.3	miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send CVE.org	>=0, <6.2.7	v6.2.7	CVE-2026-16035	Aug 4, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.