blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-0229

HIGH 8.1 CVSS 3.1
Published
March 21, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352, CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Description

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.

Affected WordPress components

  • miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) Plugin · miniorange-2-factor-authentication
    Confirmed match Active
    Before 5.5
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown miniOrange's Google Authenticator — Before 5.5
  • miniorange google_authenticator — Before 5.5

References

  • wpscan.com https://wpscan.com/vulnerability/d70c5335-4c01-448d-85fc-f8e75b104351 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record