CVE-2026-77771 Details
Description
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
An authentication bypass vulnerability has been identified in the miniOrange 2FA WordPress plugin, affecting versions prior to 6.3.1 and 19.3. The vulnerability arises because the plugin does not limit the number of second-factor authentication attempts to the specific account being targeted. Instead, it relies on a client-supplied identifier that can be easily changed, allowing attackers who know a victim's password to make unlimited guesses of one-time passcodes and bypass the two-factor authentication. Additionally, a secondary validation endpoint does not impose any attempt limit.
Users are advised to update the miniOrange 2FA WordPress plugin to version 6.3.1 or 19.3.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/e1e57673-18cb-4157-9d58-547af7101b04/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| miniOrange 2FA | < 6.3.1 (semver) < 19.3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |