WordPress Plugin Vulnerabilities

miniOrange OTP Login, Verification and SMS Notifications < 5.5.0 - Unauthenticated Privilege Escalation

Description

The plugin is affected by an unauthenticated privilege escalation vulnerability, allowing unauthenticated attackers to elevate their privileges to those of an administrator.

Affects Plugins

Plugin icon
miniorange-otp-verification
Fixed in 5.5.0

References

CVE
CVE-2026-42731
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9d979d09-a019-420e-b46e-b1d1f5e430ae

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Peng Zhou
Verified
No
WPVDB ID
d7bdbb69-f63f-45d5-8c87-93f9cb8c6ed6

Timeline

Publicly Published
2026-05-24 (about 1 month ago)
Added
2026-05-26 (about 1 month ago)
Last Updated
2026-07-03 (about 1 day ago)

Other

Published
Title
Published
2020-03-25
Title
All-in-One WP Migration < 7.15 - Arbitrary Backup Download
Published
2020-03-11
Title
Import Export WordPress Users < 1.3.9 - Authenticated Arbitrary User Creation
Published
2025-11-10
Title
Custom Fields Account Registration For Woocommerce < 1.3 - Authenticated (Author+) Privilege Escalation
Published
2026-06-30
Title
LatePoint < 5.6.4 - Agent+ Privilege Escalation to Administrator via order[customer_id] Parameter
Published
2025-11-26
Title
Tiger <= 101.2.1 - Unauthenticated Privilege Escalation