WordPress Plugin Vulnerabilities

miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

Description

The plugin does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.

Proof of Concept

Affects Plugins

Plugin icon
miniorange-2-factor-authentication
Fixed in 6.2.8

References

CVE
CVE-2026-16619

Miscellaneous

Original Researcher
Farid Narimanov
Submitter
Farid Narimanov
Submitter website
https://medium.com/@faridnarimanof
Submitter twitter
FaridNarimanov
Verified
Yes
WPVDB ID
54fc1229-3e68-4d21-baec-59a44cf12a65

Timeline

Publicly Published
2026-07-30 (about 2 days ago)
Added
2026-07-30 (about 1 day ago)
Last Updated
2026-07-30 (about 1 day ago)

Other

Published
Title
Published
2024-05-28
Title
Swiss Toolkit For WP < 1.0.8 - Contributor+ Authentication Bypass
Published
2019-12-19
Title
301 Redirects - Easy Redirect Manager < 2.45 - Authenticated Arbitrary Redirect Injection and Modification, XSS, and CSRF
Published
2022-12-29
Title
Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access
Published
2020-01-27
Title
WPS Hide Login < 1.5.5 - Secret Login Page Disclosure
Published
2016-12-23
Title
Slider <= 1.1.89 - Authenticated Arbitrary File Deletion