blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-103895

HIGH 8.1 CVSS 3.1
Published
October 16, 2026
Last modified
October 16, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-287
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.

Affected WordPress components

  • miniOrange OTP Login, Verification and SMS Notifications Plugin · miniorange-otp-verification
    Confirmed match Active
    Up to and including 5.5.8
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • cyberlord92 miniOrange OTP Login, Verification and SMS Notifications — Up to and including 5.5.8

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1050
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1170
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1519
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1573
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L511
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wploginform.php
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve
  • nvd.nist.gov Official NVD record