Miniorange Otp Verification Vulnerabilities

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the admin...

CVSS:

8.1

(Wordfence)

Affected:

up to 5.5.8

Fixed in:

5.6.0

Disclosed:

Oct 15, 2026

CVE-2026-103895 on NVD →

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.7. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate th...

CVSS:

7.3

(Wordfence)

Affected:

up to 5.5.7

Fixed in:

5.5.8

Disclosed:

Oct 8, 2026

CVE-2026-106610 on NVD →

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pa...

CVSS:

9.8

(Wordfence)

Affected:

up to 5.5.5

Fixed in:

5.5.6

Disclosed:

Sep 26, 2026

CVE-2026-85984 on NVD →

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.1. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

CVSS:

9.8

(Wordfence)

Affected:

up to 5.5.1

Fixed in:

5.5.2

Disclosed:

Aug 11, 2026

CVE-2026-61967 on NVD →

The miniorange otp verification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a...

CVSS:

7.2

(Wordfence)

Affected:

up to 5.5.1

Fixed in:

5.5.2

Disclosed:

Jul 27, 2026

CVE-2026-61957 on NVD →

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the O...

CVSS:

9.8

(Wordfence)

Affected:

up to 5.5.1

Fixed in:

5.5.2

Disclosed:

Jul 8, 2026

CVE-2026-14245 on NVD →

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.9. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

CVSS:

9.8

(Wordfence)

Affected:

up to 5.4.9

Fixed in:

5.5.0

Disclosed:

May 24, 2026

CVE-2026-42731 on NVD →

The miniorange otp verification plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the dismiss_notice function in versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss notic...

CVSS:

4.3

(Wordfence)

Affected:

up to 4.2.1

Fixed in:

4.2.2

Disclosed:

Nov 14, 2023

CVE-2023-47776 on NVD →