CVE-2026-16619 Details
Description
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
A vulnerability in the miniOrange 2FA WordPress plugin, affecting versions prior to 6.2.8, allows for an unlimited number of second-factor verification attempts. The plugin fails to properly limit these attempts, as it tracks them using a client-supplied identifier that is reset with each login. This flaw enables an attacker who knows a user's password to repeatedly guess the one-time code, potentially taking over the account.
Users are advised to update the miniOrange 2FA WordPress plugin to version 6.2.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/54fc1229-3e68-4d21-baec-59a44cf12a65/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| miniOrange 2FA | < 6.2.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |