Authentication Bypass in miniOrange 2FA WordPress Plugin
CVE-2026-111949
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111949?
The miniOrange 2FA WordPress plugin prior to version 6.3.1 allows an attacker to exploit a flaw in the pending passkey login mechanism. This vulnerability enables an attacker with knowledge of the user's password to register an additional authenticator for accounts that already have a passkey configured. As a result, the second factor of authentication can be bypassed, posing a significant security risk to user accounts.
Affected Version(s)
miniOrange 2FA 6.2.9 < 6.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.