Bypass Vulnerability in miniOrange Two-Factor Authentication Plugin for WordPress
CVE-2026-12695
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 31 July 2026
Badges
What is CVE-2026-12695?
The miniOrange Two-Factor Authentication plugin for WordPress, prior to version 6.2.6, is vulnerable to an authentication bypass. This vulnerability allows an unauthenticated attacker, who is aware of a user's password, to bypass the two-factor authentication mechanism. The flaw exists because the plugin does not properly validate the one-time password against the user's stored secret. Instead, it verifies the password against an attacker-provided value, enabling unauthorized access to user accounts, including those of administrators. This exposes sensitive information and potential account manipulation.
Affected Version(s)
miniOrange 2FA 0 < 6.2.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.