Two-Factor Authentication Vulnerability in miniOrange Plugin for WordPress
CVE-2026-16036
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16036?
The miniOrange 2FA WordPress plugin prior to version 6.2.7 contains a security flaw that fails to correctly bind the second factor during the pre-login verification process. This allows an attacker, who knows a victim's password, to reconfigure the victim's second factor to an address controlled by the attacker. Consequently, the attacker can bypass the two-factor authentication challenge and gain unauthorized access to the targeted account, potentially compromising sensitive user data and affecting administrator accounts.
Affected Version(s)
miniOrange 2FA 0 < 6.2.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.