miniOrange 2FA vulnerabilities
We track 6 vulnerabilities in miniOrange 2FA products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.
Latest miniOrange 2FA vulnerabilities
- 7.5 High severity
miniOrange 2FA: Improper Authentication
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and
- 7.5 High severity
miniOrange 2FA: Improper Authentication
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing
- 10.0 Critical severity
miniOrange 2FA: Missing Authorization
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary op
- 7.5 High severity
miniOrange 2FA: Improper Restriction of Excessive Authentication Attempts
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's pas
- 7.5 High severity
miniOrange 2FA: Improper Authentication
The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second f
- 8.1 High severity
miniOrange 2FA: Improper Authentication
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's pas