Authentication Bypass Vulnerability in miniOrange OTP Login Plugin for WordPress

CVE-2026-103895

What is CVE-2026-103895?

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress has an authentication bypass vulnerability due to a flaw in its process handling. This issue allows unauthenticated attackers to gain unauthorized access to any WordPress user account, including those of administrators. Exploitation occurs when the site is configured for OTP-only login and Delay OTP Verification, where attackers can bypass password validation by submitting only a known username and any non-empty password. This vulnerability arises from improper session handling and user metadata storage, creating significant security risks for WordPress installations using this plugin.

References