WordPress Plugin Vulnerabilities

miniOrange OTP Login, Verification and SMS Notifications < 5.5.2 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, making it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
miniorange-otp-verification
Fixed in 5.5.2

References

CVE
CVE-2026-61967
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a91a95c5-c7df-4972-b722-fe2cb4bc356f

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
VDsec
Verified
No
WPVDB ID
a5aa1e34-622d-4400-b92e-babbffcfab13

Timeline

Publicly Published
2026-08-11 (about 13 days ago)
Added
2026-08-14 (about 9 days ago)
Last Updated
2026-08-21 (about 2 days ago)

Other

Published
Title
Published
2025-10-31
Title
Doccure Core < 1.5.4 - Unauthenticated Privilege Escalation
Published
2026-03-10
Title
ExactMetrics 7.1.0 - 9.0.2 - Improper Privilege Management to Role Privilege Escalation via Settings Update
Published
2019-08-03
Title
Travel Management < 1.7 - Unauthenticated Options Change
Published
2026-05-13
Title
Essential Addons for Elementor < 6.6.0 - Author+ Limited Privilege Escalation via register_user
Published
2026-02-14
Title
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.8 - Subscriber+ Privilege Escalation