Missing Authorization in miniOrange's Google Authenticator Plugin

CVE-2025-54745

What is CVE-2025-54745?

The miniOrange 2-Factor Authentication plugin for WordPress is susceptible to a missing authorization issue that arises from incorrectly configured access control security levels. This vulnerability permits unauthorized users to exploit access controls, potentially allowing them to bypass authentication mechanisms. It affects all versions of the plugin up to and including 6.1.1. Website administrators using this plugin should ensure that proper access controls are configured to mitigate risks associated with unauthorized access.

References